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The NSA in Germany: Snowden’s Documents Available for Download 
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(U//FOUO) A Little Bad Aibling Nostalgia 

FROM: Some BA Veterans 
Unknown 

Run Date: 06/04/2004 

(U//FOUO) Once the closure of Bad Aibling Station (located in southern Bavaria in 
Germany) became official with DIR.gr am-31 2 announcing the cessation of mission, 
we thought it appropriate to give those lucky enough to have been stationed there 
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a chance to reminisce!?! 



(U) You know you are a DA veteran if„, 

,,, driving eight hours to buy pottery is a day weil spent, 

„,you get excited to see a "new release" that has been out in the States for almost a 
year, 

„, dreaming of honey wagons is anything but sweet, 

,., mixing lemon-lime soda with beer doesn't always seem like a bad idea, 

„,you have seen 10,000 people do the Macarena in a tent, 

„,you know that UPPER Bavaria is SOUTH of LOWER Bavaria, 

„, you've seen Neusch wan stern or the Glockenspiel in Munich 53 times, and never 
because YOU wanted to go, 

,., you've been to "town hall" meetings at which a final decision to close the site was 
announced in three different years, 

,,,you attended both the final closing and re-opening of the AFRO facilities at 
Chiemsee, 

Derek the car registration guy has called you "mate" , 

„,you bought a sea- van's worth of Wind ex, "just because it was in stock today", 
„,you have spent $200 worth of time to get $40 worth of Italian gas coupons, 

„, while dining, you consistently chose beer as your beverage because it was half 
the price of Coke! 

„,you missed a day of mission work to verify the slot machine take at the club, 
...you've concluded that, as a general rule in restaurants, German dogs behave 
better than some American patrons, 

,.,your windshield still has an Austrian Autobahn Toll Vignette on it, 

...driving on the Autobahn at 120 mph seems far safer than traveling the 
Washington Beltway, 

„,you know that leberkaese is made neither of liver, nor cheese, 

„,you welcomed biergarten season because a non-smoking restaurant was never an 
option. 

„,you swapped free biers for free pizza at the 4th of July fest, 

„,you understand why perfectly normal people bang tiny botties of schnapps on a 
fest table before drinking them. 

„,you purchased window screens and Velcro tape in order to keep mosquitoes from 
invading your house. 

„,you had a map of every ESSO gas station in Germany and planned your trips 
accordingly, 

...you understood why you needed to have someone guard your vehicle when you 
went pottery shopping in Poland. 

„,you packed out to return to the States, but bought more stuff and had to ship it 
home with a friend who was leaving after you, 

...you sought out the person with the schedule for working the beer booth at the 
4th of July fest. 

„,you were a recipient of a "free bier at the club" email. 
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exchange. 



(TS//S I//NF) Germ an y : Prov is io n of XKEYS CO RE softwa re to the EHV wil I 
expand their ability to support NS A as we jointly prosecute CT targets. 
Technical support forXKEYSCORE will be provided by the BND as it involves 
CES equities that a non-technical partner could inadvertently place at risk. 
Based on ourCA relationship with the BND, they are well aware of, and able 
to, protect those equities. 
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(U) Topic 

(S//REL TO USA, DEU) NSA’s Counterterrorism (CT) Relationship with the German 
Federal Intelligence Service (BND) and the German Federal Office for the Protection of 
the Constitution (BfV) 



(U) Potential Landmines 

* (TS//5I//NF) The Germans may bring up the subject of SKYPE. NSA’s response 
has been that it has had some success working SKYPE via tailored access at the 
end point by gaining access to one or more of the computers involved in the 
session. When Hr. Klaus- Fritsche (State Secietaty, Germany Ministty of Interior) 
sought NSA’s assistance with intercepting SKYPE transmissions during a 10 
January 20 12 meeting with D1RNSA, D1RNSA suggested the DN1 Representative 
Beilin take the lead in arranging an exchange to include CIA, FBI and NSA. 
Should the partner raise this issue again, recommend that NSA once again 
redirects them to FBI and CIA. 

* (S//NF) The Germans have previously approached NSA about using information 
derived from S1GINT in open court. CT is concerned that exposing S1GINT 
capabilities in German court threatens the ability to maintain the desired and 
planned for level of S1GINT cooperation. 



(U) Talking Points 

(U) Director’s Talking Points 

* (S//REL TO USA, DEU) Ensure that the Germans understand the importance that 
NSA places on its robust CT sharing relationship with the BND and the BfV, as 
w r ell as NSA’s desire to continue to move forward in the ongoing analytic and 
technical exchanges. 

* (S//REL TO USA, DEU) Acknowledge that NSA/CT now r has a formal 
relationship with the BfV (approved 20 March 2013). CT expects to receive value 
from a closer NSA/BND/BfV partnership because it will generate a greater 
synet^y to more effectively counter terrorist threats. CT is pleased that BND is 
taking a leadership role in implementing technical solutions w r hen panne ring with 
the BfV, and w r e expect this to continue. 



(U) SL GLINT Director’s Talking Points 



(S//5I//REL TO USA, DEU) Discuss and emphasize NSA’s commitment to 
continuing and increasing the exchange on discovery methodologies. The topic 

Classified By] 
Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20380401 
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and importance of using behavior detection techniques to identify unknown 
extremists w r as discussed several times in 2012 with both BND and BfV and CT 
sees great value in working closely with both German partners on these analytic 
tra dec raft methodologies. The next meeting to further discuss behavior detection 
is scheduled for 10-11 April in Bad Aibling with the BND and BfV. These 
sessions are specifically focused on unde is landing, creating, and implementing 
discovery capabilities through XKEYSCQRE. Ultimately, CT’s goal is to gain 
benefit by collaborating on German extremists tat^gets once the BfV has, and is 




(U) Background 

(TS//REL TO USA, FVEY) NSA’s CT collaborates with the BND (bilaterally and 
multilateral ly) and with the BfV (bilaterally) on a vatiety of CT issues and targets. 
Engagement in the multilateral realm is via the SIGINT Seniors Europe (SSEUR) CT 
coalition (SISECT). N1SA CT exchanges information with the BND and the BfV on the 
following topics: 




(TS//REL TO USA, FVEY) CT also provides information to the BND on the following 
topics: 
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(TS//REL TO USA, FVEY)The primary stakeholders for CT exchanges with the 
Germans are the European Cryptologic Center (ECC) and the S21 Deployed Analyst (DA 
) in Beilin. NSA’s CT meets with the BND and BfV quarterly and with the BND evety 
six months at S1SECT. The latest analytic exchange w r as on4-S December 2012 in 
Berlin. Although previous discussions focused on extremists traveling to Germany and 
Central Asia, this latest exchange focused heavily on North African CT topics, including 
key presentations from both sides on CT European targets 

remain the focus of the relationship with BfV; however, it is likely that CT North African 
targets will have an expanded focus with BND and BfV as North Africa continues to 
serve as a magnet for aspiring jihadists from Europe. In addition, future discussions will 
likely expand to Europeans traveling to^^|to fight in the ongoing^^Jand the threat 
they may pose upon return to Europe. 




(TS//5L7NF) In addition, SSG has been working with the BND and BfV on collection as 
w r ell as target discovery and development trade craft. In October 2011, SSG partnered 
with SUSLAG and BND to conduct a demonstration of XKEYSCORE to the BfV using 
BfV domestic warranted collection. The BND XKEYSCORE system successfully 
processed DSL wiretap collection belonging to a German domestic CT tat^et. As a result 
of this demonstration, the BfV Vice President formally requested the XKEYSCORE 
software from D1RNSA to further enable the BfV to achieve its mission goal of 
countering terrorist activities in Germany. By enhancing BfV’s Internet analytic 
capabilities through the provision of XKEYSCORE, NS A will enable Germany to 
provide unique con tribut ions in the form of collection, data summaries, and/or finished 
intelligence to the high-priority NSA CT mission. The SPF approving the provision of 
XKEYSCORE to the BfV w r as approved on 25 March 2013. The Terms of Reference 
related to this effort is currently with the Germans for signature, w r hich is expected in 
mid- April. 

(U) Date of Material 
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(U) a April 2013 

(U) POCs 

(U) Originator 

) : >: 

(U) Alternate POC 

(LI/F0L!0)^^^^^^| Foreign Partner Strategist, ST, 
(U) Classification Review by 
(U//FOUO)^^^^^^| Foreign Partner Strategist, ST, 
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(U) Topic 

(S//REL TO USA, DEU) NSA’s Counterterrorism (CT) Relationship with the German 

Federal Intelligence Service (BND) and the German Federal Office for the Protection of 

the Constitution (BfV) 

(U) Potential Landmines 

* (TS//SI//NF) The Germans may bring up the subject of SKYPE. NSA’s response 
has been that it has had some success working SKYPE via tailored access at the 
end point by gaining access to one or more of the computers involved in the 
session. When Hr. Kiaus-Fritsche (State Secietaty, Germany Ministty of Interior) 
sought NSA’s assistance with intercepting SKYPE transmissions during a 10 
January 2012 meeting with D1RNSA, D1RNSA suggested the DM1 Representative 
Beilin take the lead in arranging an exchange to include CIA, FBI and NSA. 
Should the pa liner raise this issue again, recommend that NSA once again 
redirects them to FBI and CIA. 

* ( S//NF) The Germans have previous ly approached N SA about using information 
detived from S1GINT in open court. CT is concerned that exposing S1GINT 
capabilities in German court threatens the ability to maintain the desired and 
planned for level of S1GINT cooperation. 

(U) Talking Points 

(U) Director’s Talking Points 

* (S//REL TO USA, DEU) Ensure that the Germans understand the importance that 
NSA places on its robust CT sharing relationship with the BND and the BfV, as 
w r ell as NSA’s desire to continue to move forward in the ongoing analytic and 
technical exchanges. 

* (S//REL TO USA, DEU) Acknowledge that NSA/CT now r has a formal 
relationship with the BfV (approved 20 March 2013). CT expects to receive value 
from a closer NSA/BND/BfV partnership because it will generate a greater 
synet^y to more effectively counter terrorist threats. CT is pleased that BND is 
taking a leadership role in implementing technical solutions w r hen panne ling with 
the BfV, and w r e expect this to continue. 

(U) SL GLINT Director’s Talking Points 

* (S//51//REL TO USA, DEU) Discuss and emphasize NSA’s commitment to 
continuing and increasing the exchange on discovery methodologies. The topic 

Classified By:^^^^ 
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and importance of using behavior detection techniques to identify unknown 
extremists w r as discussed several times in 2012 with both BND and BfV and CT 
sees great value in working closely with both German partners on these analytic 
tra dec raft methodologies. The next meeting to further discuss behavior detection 
is scheduled for 10-11 April in Bad Aibling with the BND and BfV. These 
sessions are specifically focused on unde is landing, creating, and implementing 
discovery capabilities through XKEYSCQRE. Ultimately, CT’s goal is to gain 
benefit by collaborating on German extremists targets once the BfV has, and is 




(U) Background 

(TS//REL TO USA, FVEY) NSA’s CT collaborates with the BND (bilaterally and 
multilateral ly) and with the BfV (bilaterally) on a vatiety of CT issues and targets. 
Engagement in the multilateral realm is via the SIGINT Seniors Europe (SSEUR) CT 
coalition (SISECT). N1SA CT exchanges information with the BND and the BfV on the 
following topics: 




(TS//REL TO USA, FVEY) CT also provides information to the BND on the following 
topics: 
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(TS//REL TO USA, FVEY)The primary stakeholders for CT exchanges with the 
Germans are the European Cryptologic Center (ECC) and the S21 Deployed Analyst (DA 
) in Beilin. NSA’s CT meets with the BND and BfV quarterly and with the BND evety 
six months at S1SECT. The latest analytic exchan ge w r as on 4 -5 December 2012 in 
Berlin. Although previous discussions focused on^^^^^|t raveling to Germany and 
Central Asia, this latest exchange focused heavily on North African CT topics, including 
key presentations from both sides CT European targets 

remain the focus of the relationship with BfV; however, it is likely that CT North African 
targets will have an expanded focus with BND and BfV as North Africa continues to 
serve as a magnet for^^^^^^^^M fmtn Europe. In addition, future di scussions will 

.1 n l 

they may pose upon return to Europe. 




(TS//51//NF) In addition, SSG has been working with the BND and BfV on collection as 
w r ell as target discovery and development trade craft. In October 2011, SSG partnered 
with SUSLAG and BND to conduct a demonstration of XKEYSCORE to the BfV using 
BfV domestic warranted collection. The BND XKEYSCORE system successfully 
processed DSL wiretap collection belonging to a German domestic CT tat^et. As a result 
of this demonstration, the BfV Vice President formally requested the XKEYSCORE 
software from D1RNSA to further enable the BfV to achieve its mission goal of 
countering terrorist activities in Germany. By enhancing BfV’s Internet analytic 
capabilities through the provision of XKEYSCORE, NS A will enable Germany to 
provide unique con tribut ions in the form of collection, data summaries, and/or finished 
intelligence to the high-priority NSA CT mission. The SPF approving the provision of 
XKEYSCORE to the BfV w r as approved on 25 March 2013. The Terms of Reference 
related to this effort is currently with the Germans for signature, w r hich is expected in 
mid- April. 

(U) Date of Material 
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(U) a April 2013 

(U) POCs 

(U) Originator 

(U/F0L!0)^^^^^^^^| Foreign Partner Strategist, 52 

(U) Alternate POC 

(U/F0L!0)^^^^^^J Foreign Partner Strategist, ST, 
(U) Classification Review by 
(U//FOUO)^^^^^^| Foreign Partner Strategist, ST, 
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Subject: (StfREL TO USA, FVEY) NSA Intelligence Relationship with Germany - 
Bundesnachrichtendienst (BND) 



(S//SI//REL TO USA, FVEY) Introduction : NSA established a relationship with its 
SIGINT counterpart in Germany, the BND-TA, in 1962, which includes extensive 
analytical, operational, and technical exchanges. In the past year, Germany displayed 
both eagerness and self-sufficiency in transforming its SIGINT activities and assumed 
greater risk in support of U S. intelligence needs and efforts to improve information 
sharing within the German government, with coalition partners, and NSA. The BND 
supports MSA’s emerging counterterrorism (CT) intelligence relationship with the 
German domestic services, taking steps to strengthen its SIGINT Development (SIGDEV 
) capabilities to perform a key technical advisory and support role with in Germany. Both 
pa rtn er ahaveapreedtomaintaina^ T.transnationalorganized 

crime, counter narcotics 

Special Interest Alien Smuggling (SIA), and U S. and coalition support to Afghanistan 
(the Afghanistan SIGINT Coalition (AFSC)). In 2012, NSA welcomed BND President 
Schindler’s eagerness to strengthen and expand bilateralcooperationa^ 
new analytic topics of mutual interest including Africa,^^^^^^^^^^^H and 
counter proliferation (CP)-r elated activities. In US. -Germ an cyber activity, NSA continues 
to encourage BND participation in foundational cyber defense discussions to 
demonstrate its potential to provide a technical platform. 

(S//NF) Information Assurance and Computer Network Defense Relationship with 
Germany . 

(S//NF) The Information Assurance Directorate (IAD) has a long-standing relationship 
with the Bundesamtfur Sicherheit in der Informationstechnik (B SI) - the Federal Office 
of Information Security. After the German Government announced their Cybersecurity 
Strategy and identified BSI as the lead Agency for cyber defense, BSI expressed great 
interest in expanding the information assurance (I A) partnership to include computer 
network defense (CND) collaboration on cyber threats. Key Partners within the German 
Government along with BSI, are Bundesamtfur Verfassungsschutz (BfV), Federal Office 
for Protection of the Constitution and BND. While BfV and BND have not been traditional 
I A partners, the expansion to include CND will open additional opportunities to develop 
relationships with the German agencies responsible for analysis and SIGINT. IAD and 
the NSA/CSS Threat Operations Center (NTGC) may be able to leverage the formal 
partnership the NSA Signals Intelligence Directorate (SID) is pursuing with BfV and its 
already strong relationship with BND (which is providing S IGINT Support to CND for 
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Germany’s cyber defense efforts.) A draft I A and CND Memorandum of Understanding 
(MOU) for CND collaboration is in the coordination process at NSA, BSI and BND will 
both be signatories. 



1. (U) Key Issues : 

* Issue #1: (S//SI//NF) The BND has been working to influence the German 
Government to relax interpretation of the privacy laws over the long term to provide 
greater opportunity for intelligence sharing. In the near term, NSA decided to right- 
size its presence at the Joint SIGINT Activity (JSA) in Bad Aibling, Germany based 
on current mission needs and fiscal realities. In May 2012 NSA turned over full 
responsibility of the FORNSAT collection mission to the BND, allowing NSA’s 
representational team to cultivate new cooperative opportunities with Germany. 

• Issue #2: (S//SI//REL TO USA, FVEY) Chief, Special U S. Liaison Activity Germany 
(SUSLAG), continues to work with DNI Representative Berlin on new CT initiatives 
between NSA and the BfV and with other German domestic agencies as appropriate. 
NSA has developed a significant level of trust and intelligence sharing with the BfV 
since the 2007 arrests of the Islamic Jihad Union members in Germany which 
resulted in regular U S. -German analytic exchanges and closer cooperation in 
tracking both German and non-German extremist targets. NSA also has held several 
multilateral technical meetings with BND/BfV/NSA/CIAto introduce SIGDEV 
methodology and tradecraftto improve the BfV’s ability to exploit, filter, and process 
domestic data accesses and potentially develop larger collection access points that 
could benefit both Germany and the U S. The BND supports NSA’s emerging CT 
intelligence relationship with the BfV, taking steps to strengthen its SIGDEV 
capabilities to perform a key technical advisory and support role within Germany. To 
facilitate cooperation, an NSA CT analyst, stationed in Berlin, occupies office space 
in BfV headquarters one day per week to nurture the relationship and facilitate U S. 
requirements. Likewise, the Germans developed a communications link improving the 
connectivity between NSA and BfV/BND, as well as the timeliness of the intelligence 
exchange. 

• Issue #3: (S//NF) NSA IAD, SID and NTOC are interested in leveraging Germany’s 
accesses and capabilities to discover threats and vulnerabilities which provide timely 
warnings of attacks against U S. Government and critical infrastructure networks. In 
December 2012, representatives from NTOC and FAD met with BSI and BND in 
Germany for bilateral CND discussions. As a result of the engagement, an analytical 
exchange was held in January 2013. 

(U) Discussion : 

* (S//NF) NSA’s in-country representative is the Chief, SUSLAG, located on Mangfall 
Kaserne in Bad Aibling, Germany. SUSLAG has 18 personnel, consisting of 12 NSA 
civilians and six contractors. NSA has plans to reduce the SUSLAG workforce to 
approximately six personnel in FY 2013. 
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• (S//S1//REL TO USA, FVEY) What we provide to the partner : NSA has provided a 
significant amount of hardware and software at BND expense, as well as associated 
analytic expertise to help the BIMD independently maintain its FORNSAT capability. 
IMSA also exchanges intelligence reporting on both military and non -military targets. 

• (TS//SI//NF) What the partner provides to us: I MSA is provided access to FORIMSAT 

communications supporting ON, and Weapons of Mass Destruction 

(WMD) missions and is an important source of information on drug trafficking and 
force protection in Afghanistan. The BND provides Igbo I anouaoe support by 
translating NSA collection of a high-value, time-sensitive ta rget. N S A i s 
seeking the proper approvals to accept BND language supportinBBHII^IHHIi 

In addition to the day-to-day collection, the Germans have offered 
NSA unique accesses in high interest target areas. 

(U) Success stories: 

• (S//REL TO USA, FVEY) Germany has become an active participant in the AFSC, 
working closely with other member countries and embracing the new AFSC Division 
of Effort, under which each member country is responsible for covering a specific 
area of interest to the AFSC and then sharing reporting and metadata on that area 
with the other AFSC members. AFSC member countries include: the U S, UK, 
Canada, Australia, New Zealand, Belgium, Denmark, France, Germany, Italy, 

Norway, the Netherlands, Spain and Sweden. 

• (TS//SI//REL TO USA, FVEY) Having modernized itscommunicationsinft astructure 

in support of its unique FORNSAT GSM access in BND 

became the third largest contributor to the Real Time -Regional Gateway (RT-RG) 
analysis and processing tool, 

• (S//REL TO USA, FVEY) The German government modified its interpretation of the 
G-10 Privacy Law, protecting the communications of German citizens, to afford the 
BND more flexibility in sharing protected information with foreign partners. 

• (S//SI//RELTO USAjFVEY) The BND has provided uniquesustained collection of 

targets such as ^^^^Vlinistry of Foreign Affairs (MFA) FA,^^^| Global 

System for Mobile Communications (GSM), ^^^^GSM, and Voice over 
Intern et P r otocol (Vo I P ) . 

• (TS//SlflNFi Problems/C hallenaes with the partner : Since 2008 NSA has started to 
foster other areas of cooperation with the BND to satisfy U S. intelligence 
requirements at an appropriate level of investment. The BND’s inability to 
successfully address German privacy law (G-10) issues has limited some operations, 
but NSA welcomed German willingness to take risks and to pursue new opportunities 
for cooperation with the U S, particularly in the CT realm. NSA i s open to holding a 
dialogue on topics to address mutual intelligence gaps, including 

m an d C P -r el ated act i vi ti es . 

(S//REL TO USA, FVEY) Prepared by: Country Desk Officer (CDO) 
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BOUNDLESSINFORMANT - Frequently Asked Questions 
09 - 06-2012 



(U/FOUO) Questions 

1) What is BOUNDLESSINFORMANT ? What is its purpose? 

2) Who are the intended users of the tool? 

3) What are the different views? 

4) Where do you get your data? 

5) Do you have all the data? What data is missing? 

6) Why are you showing metadata record counts versus content? 

7) Do you distinguish between sustained collect and survey collect? 

8) What is the technical architecture for the tool? 

9) What are some upcoming features/enhancements? 

10) How are new features or views requested and prioritized? 

11) Why are record counts different from other tools like ASDF and What’s On Cover? 

12) Why is the tool NOFORN? Is there a releasable version? 

13) How do you compile your record counts for each country? 



Note: This document is a work-in-progress and will be updated frequently as additional 
questions and guidance are provided. 

1) (U) What is BOUNDLESSINFORMANT ? What is its purpose? 

(U//FOUO) BOUNDLESSINFORMANT is a GAO prototype tool for a self-documenting SIGINT 
system. The purpose of the tool is to fundamentally shift the manner in which GAO describes its 
collection posture. BOUNDLESSINFORMANT provides the ability to dynamically describe GAO's 
collection capabilities (through metadata record counts) with no human intervention and graphically 
display the information in a map view, bar chart, or simple table. Prior to 

BOUNDLESSINFORMANT, the method for understanding the collection capabilities of GAO's 
assets involved ad hoc surveying of repositories, sites, developers, and/or programs and offices. By 
extracting information from every DNI and DNR metadata record, the tool is able to create a near real- 
time snapshot of GAO's collection capability at any given moment. The tool allows users to select a 
country on a map and view the metadata volume and select details about the collection against that 
country. The tool also allows users to view high level metrics by organization and then drill down to a 
more actionable level - down to the program and cover term. 

Sample Use Cases 

• (U//FOUO) How many records are collected for an organizational unit (e.g. FORNSAT)? 

• (U//FOUO) How many records (and what type) are collected against a particular country? 

• (U//FOUO) Are there any visible trends for the collection? 

• (U//FOUO) What assets collect against a specific country? What type of collection? 

• (U//FOUO) What is the field of view for a specific site? What countriees does it collect 
against? What type of collection? 

2) (U) Who are the intended users of the tool? 

• (U//FOUO) Mission and collection managers seeking to understand output characteristics 
of a site based on what is being ingested into downstream repositories. 
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• (U//FOUO) Strategic Managers seeking to understand top level metrics at the 
organization/office level or seeking to answer data calls on NS A collection capability. 

• (U//FOUO) Analysts looking for additional sites to task for coverage of a particular 
technology within a specific country. 

What are the different views? 

(U//FOUO) Map View - The Map View is designed to allow users to view overall DNI, DNR, or 
aggregated collection posture of the agency or a site. Clicking on a country will show the collection 
posture (record counts, type of collection, and contributing SIGADs or sites) against that particular 
country in addition to providing a graphical display of record count trends. In order to bin the records 
into a country, a normalized phone number (DNR) or an administrative region atom (DNI) must be 
populated within the record. Clicking on a site (within the Site Specific view) will show the viewshed 
for that site - what countries the site collects against. 

(U//FOUO) Qrg View - The Organization View is designed to allow users to view the metadata record 
counts by organizational structure (i.e. GAO - SSO - RAM-A- SPINNERET) all the way down to the 
cover term. Since it’s not necessary to have a normalized number or administrative region populated, 
the numbers in the Org View will be higher than the numbers in the Map View. 

(U//FOUO) Similarity View - The Similarity View is currently a placeholder view for an upcoming 
feature that will graphically display sites that are similar in nature. This can be used to identify areas 
for a de-duplication effort or to inform analysts of additional SIGADs to task for queries (similar to 
Amazon’s “if you like this item, you’ll also like these” feature). 



(U) Where do you get your data? 

(U//FOUO) BOUNDLESSINFORMANT extracts metadata records from GM-PLACE post- 
FALLOUT (DNI ingest processor) and post-TUSKATTIRE (DNR ingest processor). The records are 
enriched with organization information (e.g. SSO, FORNSAT) and cover term. Every valid DNI and 
DNR metadata record is aggregated to provide a count at the appropriate level. See the different views 
question above for additional information. 



(U) Do you have all the data? What data is missing? 

• (U//FOUO) The tool resides on GM-PLACE which is only accredited up to 
TS//SI//NOFORN. Therefore, the tool does not contain ECI or FISA data. 

• (U//FOUO) The Map View only shows counts for records with a valid normalized number 
(DNR) or administrative region atom (DNI). 

• (U//FOUO) Only metadata records that are sent back to NSA-W through FASCIA or 
FALLOUT are counted. Therefore, programs with a distributed data distribution system (e.g. 
MUSCULAR and Terrestrial RF) are not currently counted. 

• (U//FOUO) Only SIGINT records are currently counted. There are no ELINT or other “INT” 
records included. 

(U) Why are you showing metadata record counts versus content? 

(U//FOUO) 

(U) Do you distinguish between sustained collect and survey collect? 

(U//FOUO) The tool currently makes no distinction between sustained collect and survey collect. This 
feature is on the roadmap. 
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8) What 



is the technical architecture for the tool? 

Click! | for a graphical vim of Lhe tool's architecture 

(U//FOUO) DN1 metadata (A5DF), DNR metadata (FASCIA) delivered to Hadoop 
Distributed File System (HDFS) on GM- PLACE 

(U//FOUO) Use Java MapReduce job to transfomVfilter and enrich FASC1A/ASDF data with 
business logic to assign organization rules to data 

(U//FOUO) Bulk import of DNl/'DNR data (serialized Google Protobuf objects) into 
Cloudbase (enabled by custom aggregators) 

(U/'/FOUD) Use Java web app (hosted via Tomcat) on Machines hop (formerly Turkey Tower) 
to query Cloudbase 

(U//FUUO) GUI triggers queries to Cloud Base - G XT (ExtGWT) 



9) What 



are some upcoming features enhancements? 

(U//FOUO) Add technology type(e.g. JUGGERN AUT, LOPER) to provide additional 
granularity in the numbers 

(U//FOUO) Add additional details to the Differential view 
(U//FOUO) Refine the Site Specific view 
(U/'/FOUD) Include CASN information 

(U/'/FOUD) Add ability to export data behind any view (pddg,sigad,sysid*casn*tech*count) 
(U/'/FOUD) Add in selected (vs. unselected) data indicators 
(U/'/FOUD) Include filter for sustained versus survey collection 



10) How are new feature s or view s requested and prioritized? 

(U//FOUO) The team usesKHEB to accept user requests for additional functionality or 
enhancements. Users ate also allowed to vote on which functionality or enhancements are most 
important to them (as well as add comments). The BOUNDLESSINFORMANT team will periodically 
review all requests and triage according to level of effort (Easy, Medium, Hard) and mission impact 
(High, Medium* Low). The team will review the queue with the project champion and government 
steering committee to be added onto the BOUNDLESSINFORMANT roadmap. 



11) Why are record counts different from other tools like ASDF and What’s On 
Cover? 

(U//FOUO) There area number of reasons why record counts may vary. The purpose of the tool is to 
provide 
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FSTH 

CNI 



US-9 87 LA 471.258.864 Records 




XKEYSCORE: 182,009,301 Records 



LOPERS: 131,473,239 Records 



JUGGERNAUT: 93,612,691 Records 



CERF CALL MOSES1: 39,514,727 Records 



MATRIX: 7,977,207 Records 
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United Kingdom - Collection Information =+ m 

Summary 



Project Name 


Validator ID 


1 Day Count 


3 Day Count 


30 Day Count 


It IP 


ACRID MIN I 


100035321 


0 


0 


68 


146.185.26.163 


A 


LUTEUSICARUS 


100033767 


0 


0 


51 


37.130.229,100 




HEAD MOVIES 


6210000230 


0 


1 


30 


85.237.211.198 




APERTU RESCIENCE 


610607131 


0 


0 


29 


85.237.212.52 




CROSSEYEDSLOTH 


610209553 


0 


1 


27 


85.237.211.177 




CROSSEYEDSLOTH 


610209558 


0 


0 


20 


212.118.232.184 




KOALAPUNCH 


610210091 


0 


0 


8 


212.118.232.50 




BALLOONKNOT 


610210370 


0 


0 


6 


176,249.28.104 




APERTU RESCIENCE 


610607533 


0 


0 


6 


212.118.232.140 




MAGNUMOPUS 


100032919 


0 


0 


5 


37.130.229.101 




WAXTITAN 


610102256 


0 


2 


4 


31.6.17.94 




MAGNUMOPUS 


611000994 


0 


0 


4 


84.45.121.218 




WILD COUGAR 


611001840 


0 


0 


3 


80.84.63.242 




MURPHYSLAW 


621000039 


0 


0 


2 


37.220.10.28 




DARKFIRE 


610208689 


0 


0 


2 


94.229.78,58 


T 
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^ Top 5 Validator IDs 
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ACRID MIN I: 68 counts 



LUTEUS ICARUS: 51 counts 



100035321: 68 Counts 



100033767: 51 Counts 



146.185.26,163: 68 counts 



37.130.229.100: 51 counts 



CROSS EYED SLOTH: 48 counts 



APERTU RESCIENCE: 35 counts 



HEAD MOVIES: 30 counts 







6210000230: 30 Counts 






85.237.211.196: 30 com 



610607131: 29 Counts 



610209553: 27 Counts 



85.237.212.52: 29 counts 



85.237.211.177: 27 counts 
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US-9 85 HA: 181,115,922 Records 



|l' 



US-987LE: 81,786,967 Records 



US-91 6A: 71.319,443 Records 



US-985D: 70,271,990 Records 



DRTBOX: 547.255.556 Records 



XKEYSCORE: 182,009,301 Records 



LOPERS: 131,433,608 Records 



JUGGERNAUT: 93,612,691 Records 



:r 



GERF CALL MOSES1: 39,514,727 Records 
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a fcs 

I N MAR 

H MOIP 
HPCF 
5 VSAT 
FSTH 
j CNI 



DS-800: 4,412,803,504 Records 



LOPERS: 4,510,421,833 Records 



DS-2Q4A: 1.691.419.171 Records 



* 



FALLOUT: 2,353.011,784 Records 



UKC-302A: 1.245.109.650 Records 



JUGGERNAUT 



1.018.007.659 Records 



UKC-215: 937,317,036 Records 



TERRAIN: 759,466,600 Records 



US-9 87 LA: 471.258.864 Records 



DRTBOX: 



637,165.195 Records 
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(LAST 33 DAYS) 

TOTAL DNI 

97 , 111 , 188,358 

TOTAL DNR 

124 , 808 , 692,959 

SIGADS 

504 

CASE NOTATIONS 

27,798 

PROCESSING SYSTEMS 

2,431 
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United States - Collection Information 



Summary 



Project Name 


Validator ID 


1 Day Count 


3 Day Count 


30 Day Count l w 


IP 




CHQCQLATESHIP 


611002101 


0 


3 


393 


50.115.118.140 


A 


SCREAMING HARPY 


6220000244 


0 


3 


246 


198.144.105.223 




WILDCHOCOBO 


611001475 


0 


25 


240 


198.105.215.147 




SCREAMING HARPY 


610104864 


0 


0 


163 


216.172.135.136 




MURPHYSLAW 


611001458 


0 


0 


143 


199.127.100.25 




WH IS TUNG DIXIE 


6210000204 


0 


4 


127 


68.68.107.164 




CHAOS OVERLORD 


6220000213 


0 


1 


90 


68.68.108.69 




WAXTITAN 


610104408 


0 


5 


68 


65.49.68.162 




SHAREDTAFFY 


61070029 


0 


0 


51 


37.72.168.84 




POTBED 


610606190 


0 


1 


47 


198.144.107.45 




DARKTHUNDER 


610607532 


0 


0 


42 


216.172.135.105 




LUTEUSICARUS 


100033767 


0 


0 


39 


50.115.119.172 




DARKTHUNDER 


610607587 


0 


0 


38 


198.144.107.244 




JEEP FLEA 


6210000100 


0 


5 


37 


69.175.29.74 




SHARP SHADOW 


611001429 


0 


3 


36 


184.154.95.24 
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^ Top 5 Validator IDs 

(bp 30 d Sf COLT t) 



: + 



ir Top s ips 

(tip 10 dap CiJJ-t; 



SCREAM IN GHARRY: 409 counts 



CHOCOLATES HIP: 393 counts 



WILDCHOCOBO: 240 counts 



DARKTHUNDER: 228 counts 



WAXTITAN: 169 counts 



611002101: 393 Counts 



6220000244: 246 Counts 



611001475: 240 Counts 



610104864: 163 Counts 






611001458: 143 Counts 



50.115.118.140: 393 counts 



198.144.105.223: 246 counts 



198.105.215.147: 240 counts 



216.172.135 



136: 163 counts 



199.127.100.25: 143 counts 
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Presentation Title and Presenter 



Location 



As of: 22 April/0300 Hrs 



President, 



Mr. Andreas Kdnen 

Federal Office of Information Security (BS1), Getmany 



1315 (U//FOUO) Welcome GH 1 

Mr. Andreas Konen 




1330-1400 



(U/' FOLIO) NSA Information Assurance Directorate (1AD) 
Courtesy Call 

D J R 1 nf o nn a d on Assurance 
Jnfotmation Assurance 

(By Invitation Only) 



2C120 



1400-1500 fU//FOUO) NSA C ommercial Product Strategy and FJ SHBOWL 

| Technical Director, Mobility Mission 
Management Team (M3T) 



2C120 



1500-1530 (U//FOUO) Nation al Information Assurance Partnership (N1AP) 

Director, MAP 



2C120 



1530 



(U) Depart 

Met and escorted by 

Officer. 



GH 1 



NSA/CSS Protocol 



Classified 

Derived Emm: NSAfSSM I 52 



Dated: 200701 OS 
Declassify On: 203S0401 
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(U//FOUO) European Security Center to Begin Operations 

USA 

Chief’ Operations Division, Array Cryptologic Operations (AGO) 

Run Date: 03/29/2004 

(S) A new tactical SIGINT producer will soon be up and running in Europe, On 10 
March, MG^^^B(SID) and MG of the Army's Intelligence and Security 

Command (INSCOM) signed the C on c e pt o f Q p e r ati o ns for the European Security 
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Center (ESC), setting the stage for an April start of formal SIGINT operations in 
Darmstadt, Germany, The ESC (USM-44) will perform SIGINT operations primarily 
in support of U,S, Army Europe and the European Command, but it will also 
conduct mutually beneficial, cooperative missions with various SID Product Lines, 



(C) The ESC is a fixed site facility that will provide crisis support to military 
operations throughout the European Command theater, which includes not only 
Europe, but also much of Africa and parts of the Middle East, Working with a 
collocated INSCOM Theater SIGINT Battalion (TSB), the ESC will also provide an 
on-demand survey capability and deploy tailored front-end collection eguipment. It 
will be a complete production facility, performing collection, processing, analysis 
and dissemination, 

(C) The Center will also support theater SIGINT soldiers assigned at tactical 
echelons. It will serve both as a formal training center where those soldiers 
routinely train and maintain technical and language skills, and as a deployment 
center for soldiers who directly support contingency missions and combat 
operations. 



(C) The ESC is initially staffed by SIGINT soldiers of INSCOM 's 66th Military 
Intelligence Group, augmented by Army civilians and contractors. In the near term, 
they will be assisted by SID augmentees who possess critical skills, with the 
appropriate level of long-term SID support to be assessed as the ESC matures. 
Initially an "Army" organization, the ESC is a flexible construct that could 
potentially host personnel and missions from other Services and Agencies, 

(C) The ESC is housed in two new SC IF** structures (over 10,000 sguare feet) 
adjacent to an existing Army Operations SCIF that houses other Army theater 
intelligence support missions, allowing an enhanced all-source effort against 
theater requirements. Current ESC systems and capabilities include 59 Distributed 
Common Ground Station - Army (DC GS -A) workstations, IIIGIICASTLE (for voice 
processing and analysis and reporting), the TROJAN CLASSIC XXI collection, 
processing, analysis and reporting system, and an Emitter Mapping suite. Planned 
reconfiguration includes a "Linguarium", a novel construct to consolidate, focus 
and enhance voice analyst capabilities and productivity, 

^^/F^UO^Arn^^oints of Contact: 

<: ) i >o rati o n s> D iv i si o n . Ar my ( 1 ry\ >tolo gi c ( "J p e ra f i o n s 

!3 j Chief AGO Operations Fieid Support and European Desk Officer 



(U/ /FOUQ) SI D Points of Contact: 

_£hiefTechnical Support Program Management Office (TSPMO) 

eputy Chief 




**SC IF = Sensitive Compartmented Information Facility 
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{^/FOUO^^h^Europoan. Security Center to Become the 'ESOC 1 

wmmm 

A&P's Director, Enterprise Management (S2) 

Run Date: 09/11/2006 



(S//SI) NSA to help build up capabilities of the intelligence center in Darmstadt , 
Germany... 
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(S//SI) Good as it is, the ESC is about to get better. On 5 July 2006, the 
Director, NSA approved the "ESOC Concept" which transforms the European 
Security Center (ESC) into the European Security Operations Center (ESOC), 
With this move, NSA will help build up the Center's capabilities to allow it to 
assume even greater responsibilities within the worldwide SIGINT Enterprise, 
What will change, specifically? 

(U) More Missions 

(S//SI) Beginning in FY07 through FY13, the ESOC will evolve by expanding or 
adding more missions that will support national, theater and regional intelligence 
needs, ESOC's new or expanded missions include: 

* additional select Counterterrorism targets, 

* the African Union, 

* Nigerian Energy Security, 

* targets in Morocco, Algeria, Tunisia, and Libya, and 

* complementary capabilities in SIGINT Development, Geospatial Analysis and 
Technical SIGINT 

(U) Changes In Manning 

(S//SI) . ..But that's not the only change. To ensure manning stability and to foster 
true national/tactical integration, a core of NSA civilians and multi-service Service 
Cryptologic Element military personnel* will work side-by-side with the (primarily) 
Army tactical SIGINT personnel who have manned the ESOC since its start-up. 



(S) ESOC personnel at work 

(U) Background: The ESC 

(TS//SI) The European Security Center, primarily a theater SIGINT Center manned 
by Army Tactical SIGINT personnel from the 1 05th Military Intelligence Battalion 
in Darmstadt, Germany, was created over two years ago. It was the first center to 
use tactical resources - augmented by a few NSA civilians -- to work both theater 
information needs as well as national missions. 

(TS//SI) Today, the ESC is highly successful in producing intelligence for both 
national customers and the European Command, Its national mission focuses on 
select Counterterrorism targets, select Sub-Saharan Africa and North Africa target 
sets, SIGINT Development and Geospatial Analysis missions. Its theater missions 
include Force Protection, Global War on Terrorism support, Pan Sahel**, and 
targets in West Africa. 

(TS//SI) The ESCs most recent SIGINT accomplishments include providing the 
majority of reporting and target tracking on the April 2006 coup attempt in Chad; 
providing linguistic and analytic support during the on-going Israeli- Lebanon crisis 
and providing analytic and linguistic support which facilitated the arrests of 
terrorist facilitators operating in Italy, 



(S//SI) The "ESOC Concept" 




(S//SI) The decision to move forward with the creation of the ESOC was founded on 
the site's ability to,,, 

* contribute to the national mission, 

* plug into Theater all-source elements, 

* optimize support to Theater operations, 

* provide tactical over- watch (intelligence support to deployed troops), and 

* maximize Second and Third party partnerships. 

Under DIRNSA guidance, the US Army will retain its role as Executive Agent and 
Cryptologic Host for the new ESOC, 

(S//SI) When fully realized, the “ESOC Concept" will be a model for future 
national/tactical integration, by providing an in- theater capability to produce 
high-impact analysis in support of all levels of national, tactical and Theater 
information needs. 



(U//FOUO) POCst 




(U//FOUO) The ESOC 



(U) Notes: 

*(U//FOUO) The multi-service SCE military personnel are part of the Consolidated 
Cryptologic Program (CPE, also known as “PS"), Army tactical SIGINT personnel 
are known as "P2," 

**(U) The Pan Sahel Initiative (PS I) is a State Department -led effort to assist Mali, 
Niger, Chad, and Mauritania in detecting and responding to suspicious movement 
of people and goods across and within their borders. 
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(S//SI//REL) Starting Up a New Mission at the European Security 
Operations Center: End-to-End SIGINT 



FROM 

Intelligence Analysis Intern 
Run Date; 12/05/2007 



(S//SI//REL) When considering possible TDY and deployment locations, many of my 
Intelligence Analysis Development Program (IADP) colleagues have opted for Iraq, 
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Afghanistan, or an SCS site. At least for now, I chose to avoid the heat and sand and 
took advantage of a different opportunity for my fourth IADP tour. From 
May -September 2007, I completed a TDY from Ft, Meade to the European Security 
Operations Center (ESOC) in Darmstadt, Germany, 



(U//FOUO) The ESOC 

(S//SI//REL) ESOC, which stood up in April 2004 (see some background ), is a joint 
Army/NSA SIGINT operations center and serves as the S2/Analysis & Production 
arm of NS A/CSS Europe (MCEUR), ESOC's personnel mix consists of 105th MI 
Battalion soldiers, a small Marine detachment, contractors, Department of the 
Army civilians, and NS A civilians in Darmstadt and Stuttgart in Germany as well as 
in Molesworth, England, and Mons, Belgium, ESOC's missions include African 
Regional Targets, North African and European Counter-Terrorism missions, Force 
Protection/Indications & Warning, and theatre SIGDEV 

(S//SI//REL) During my tour, I was assigned to the Africa Division and provided 
ESOC with target development support for the Gulf of Guinea Hydrocarbon 
Security mission, consisting primarily of Nigerian and Angolan targets. My 
particular focus was to launch the Africa Division's energy security mission 
covering Angola, 

(S//SI//REL) Working African missions often present unique challenges, and both 
the Nigerian and Angolan energy sectors were certainly no different. While ESOC 
had worked the Nigerian energy security mission for over two years, due to 
resource constraints, relatively little development work had been done against the 
An golan target. The larger Gulf of Guinea Hydrocarbon mission consisted of 
several analysts, a branch manager, and a technical leader, but it was largely up to 
me to do the bottom-up target development work in building the Angola mission. 



(U) The Gulf of Guinea and surrounding region 

(S//SI//REL) The task was somewhat daunting, Angola's state- owned oil firm, 
Sonangol, is a massive entity with its own airline, logistical service firms, and 
importantly, its own telecommunications subsidiary, Sonangol partners with several 
major Western and Chinese oil companies, and Chinese firms are heavily involved 
in the telecommunications sector. Our collection was minimal, and our day-to-day 
Angola team was essentially one deep: me, 

(S//SI//REL) We compiled a detailed assessment and established good baseline 
knowledge of our current SIGINT posture in Angola, We reviewed existing SCS 
First Instance Reporting, and had several fruitful exchanges with SCS Luanda in 
Angola, We also worked closely both with ESOC's in-house SIGDEV elements and 
the European Technical Center to begin a target templating process and draft 
collection requirements. Through collaboration with CIA and EUCOM JAC* Africa 
Division's understanding of our customer and partner requirements improved 
significantly. 



(S//SI//REL) In order to gain a SIGINT window into Angola's telecom sector and 
energy industry, we chose to continue to chip away at Sonangol, Relying on skills 
and contacts acquired in previous IADP tours, I conducted intensive SIGINT 
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research on Sonangol seed selectors using chaining, metadata analysis, and 
visualization tools such as Cmap and Renoir My target development work spanned 
both the DNI and DNR realms. We were able to identify and unlock Sonangol target 
domains, locate and task e-mail selectors in CADENCE , and identify several new 
targets in the Angolan oil and telecommunications sectors, 

(S//SI//REL) A key part of my tour at ESOC was identifying new potential collection 
accesses. Using open source, PINWALE. BLACK PEARL. NKD . ROADBED , and 
SURREY. I successfully located, identified, and submitted several new targets for 
FORNSAT and SCS collection. Partnering with ESOC SIGDEV SCS, and FORNSAT 
collection staff at Ft, Meade and elsewhere, we were able to draft and submit the 
first collection requirement for the Angola energy mission. By the end of my tour 
ESOC had seen a significant increase in Angola energy traffic. We also were able to 
issue the first product of the Angola mission, a jointly issued report between the 
Africa division and ESOC SIGDEV 

(S//SI//REL) My tour at ESOC was an excellent exercise in end-to-end SIGINT to 
include initial research and target development, collection access discovery and 
tasking, and issuing products. My understanding of the SIGINT process improved 
greatly during my time at ESOC, The recent stand-up of the U,S, African Command 
(AFRICOM), co -located with EUCOM in Stuttgart, Germany is certain to create 
even more opportunities for analysts to support ESOC's missions in a dynamic 
environment. 



(U) Notes: 

* (U) EUCOM JAC = the European Command Joint Analysis Center 
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(U//FOUO) The ECC -- NSA's Newest Cryptologic Center 



FROM; 

SIGINT Director 

Run Dates: 06/10/2011 , 06/13/2011 

(S//REL) On 9 May NSA established the European Cryptologic Cente 
(ECC) from what was formerly the European Security Operations 
Center (ESOC), The ECC will fall organizationally under NSA/CSS 




Europe and Africa (NCEUR/AF), This is more than just a name 
change; it is furthering the commitment of the National Security 
Agency to a long-term mission presence in Germany, The name and 
accompanying organizational change reflect a recognition of the 
broader mission being supported from the ECC, as well as the strengthening of the 
analytic mission at the center, 

(S//REL) In addition to the well-established SIGINT analytic and collection 
management missions, there is now an NSA/CSS Threat Operations Center (NTOC) 
and IT component to the center, ECC's enhanced analytic mission is a welcome 
development. The organization is a critical enterprise partner in the CT Africa, and 
Middle East missions, 

(S//REL) Since its beginnings in 2004 as the European Security Center (ESC), the 
ECC has been a success story in terms of SIGINT mission accomplishments and 
growth. In the last four years alone, the ECC’s Analysis and Production mission set 
has increased from 5 to 26 distinct assigned missions, becoming the largest 
Analysis and Production activity in Europe, Complementing this rapid mission 
expansion has been an increased collaborative effort with foreign partners, with 
multiple IC members, and across the SIGINT Enterprise, 

(S//REL) The quality and significance of ECC’s SIGINT accomplishments speak for 
themselves. In the last month alone, ECC was a key contributor to the arrests of 
two key terrorist personalities, underscoring its refined collaborative environment. 
Overall, ECC products are included in the President’s Daily Brief (PDD) on average 
twice a week. Further, for the second time in as many years, the ECC recently 
received an Honorable Mention citation in competition for the prestigious Travis 
Trophy award, 

(S//REL) Located in Darmstadt, Germany, the ECC currently has a total of 240 
personnel, a diverse mix of military service members, Department of the Army 
civilians, NS A civilians, and contractors. The ECC has responded to new 
intelligence priorities generated by the standup of AFRICOM, and has assumed 
new TOPI responsibilities in both the US European Command (EUCOM) and US 
Africa Command (AFRICOM) areas of responsibility. 

(U//FOUO) Please join us in congratulating the ECC and its outstanding workforce 
on their accomplishments and welcoming them as NSA's newest cryptologic center. 




H (U/FOUO) View of the ESOC 



2 of 3 




3 of 3 




(U//F0L10) Dragons, Shrimp, and XKEYSCORE: Tkles from the Land of 

Brothers Grimm 

European Cryptologic Center, SIGDEV (F22) 

Run Date: 04/13/2012 

(S//REL) The European Cryptologic Center (ECC) sits 
quietly nestled amongst vineyards and farmlands on 
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ECC 



the outskirts of Darmstadt, Germany, To the passing 
motorist, the facility looks like many of the other 
random U,S, government facilities in the area, with 
one exception. One can almost hear a discemable 
buzz of activity from the analysts of the ECC 
executing queries, authoring fingerprints, and 
consuming metadata garnered from XKEYSCORE (XKS), In the past three months, 
the ECC has tripled, and even quadrupled in some cases, the number of queries 
performed, the number of items pushed to PIN WALE, and the number of sessions 
viewed. And these numbers continue to grow,* 

(S//REL) What has been the cause of this flurry of success? The ECC points to a 
recent XKS training blitz in support of the Analytic Modernization Outreach 
Campaign to encourage discovery. In early March, ECC SIGDEV analysts held 
an XKS Circuit Training event designed to expose analysts to five, 20-minute 
one-on-one sessions in a circuit-type environment. This "speed dating" for XKS 
consisted of five stations covering topics titled ‘"Intro to the GUI and Basic 
Queries," "Metadata Setup and Manipulation," "Content and Manipulation of 
Results," "Introduction to Fingerprints," and "Introduction to Microplugins," 

(S//REL) Over four days, 68 students were walked through these topics with five 
different instructors, able to ask specific questions and get more comfortable with 
the tool, "Everyone likes a new toy, and there was a lot of excitement about it. They 
will at least try it against their target and see what they will get out of it," said 
mone of the instructors and a SIGDEV Analyst embedded in Africa 
Division, 

(S//SI//REL) With traditional targeting, analysts cast their nets wide into the murky 
waters of network traffic and haul in anything that gets caught in the net. We are 
like Forrest Gump on his shrimping boat off the coast of Alabama pulling in a boot, 
toilet seat, seaweed, and there they are,,, three shrimp! We bum up a lot of 
resources getting those shrimp, those reportable documents or metadata used to 
expand target knowledge, and we deal with tons of toilet seats, the spam and other 
junk. Then, we repeat the same process and hopefully catch enough "shrimp" to 
have ourselves a little cocktail, XKS has become so important because with it, 
analysts can downsize their gigantic shrimping nets to tiny, handheld goldfish-sized 
nets and merely dip them into the oceans of data, working smarter and scooping 
out exactly what they want. 

(U//FOUO) And a short, two-hour class is an easy gamble of time for the hopes of 
being able to work smarter and more efficiently, ECC analysts have been trading in 
their old nets for new ones and are thrilled with their catches. Discovery can only 
occur if people are willing to try new things, and more of our analysts are getting 
comfortable with leaping into the relatively unknown world of XKS. 

(U//FOUO) "The first time I saw XKS, I said, "Whoa!!" It i^ntimidating because you 
open it up and you see all these queries and fields," said^^^^^l "We took the 
students from that response to being able to approach it and navigate around in it. 
They see it differently now and know it's not a seven-headed dragon," This gentle 
introduction has definitely enabled analysts to ease into XKS and get more 
comfortable, and with that it has radically changed the overall mentality towards 
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the tool. 



(S//R EL) Across the ECC analysts wholeheartedly agree that the Circuit 
Training setup and content was a catalyst to give XKS a try or take existing 
users to the next level. The one-on-one setup provided a heavy injection of tool 
knowledge into eac h student. ‘'Be fore the training, I was just happy to use it and 
not go to jail," said a Circuit Training student and AraMc/French 

Language Analyst for CT (Counterterrorism). "Now, I feel comfortable in my ability 
to use it and NOT go to jail. I used to always ask someone to look over my query 
before I submitted it. Now, my hand doesn't need to be held." 

(S//REL) That Circuit Training must be one tough training to puU off, you say? Not 
so, says ^^^^^|who spoke about the "off-the-shelf" nature of the training. "The 
framework was already developed by GCIIO . so it was simple for us to read over 
their notes, make it applicable to NSA, and conduct the training. We didn't have to 
spend time writing modules." 

(TS//SI//REL) From the leadership level's perspective, the time invested sending 
analysts to the class had a tremendous return. Tech Lead for the 

50-person strong Africa Division, said, "The brevity of the class made it easy to 
send our people. Now we know exactly why we want to use it, and we have 
discovered new traffic and documents. Our analysts have been building hashes for 
document tracking and rolling them into fingerprints. We have been getting 
documents in XKS that we were not getting in our PIN WALE queries. Just today 
analysts found reportable material from the Tunisian Ministry of Interior that was 
not from any selectors we were targeting. Now we know what we can do with XKS 
and exactly why we want to use it - to make these discoveries." 

(S//REL) These discoveries are igniting a trend of using XKS on a daily basis. "For 
daily pulls, analysts go through TransX, PINWALE, and now XKS to see what's new 
for the day, aid. 

(U//FOUO) Combine these exciting finds with the introduction of XKS Skilz points, 
and you can see why McDonald's teamed up with Monopoly years ago: people buy 
more and even super size their orders just to get game pieces. With the brainchild 
of Skilz, where analysts can earn points and unlock achievements for performing 
tasks in XKS, people are willing to try new things within the tool. Analysts think to 
themselves, "Using the Pivot Data feature will earn 30 points., , I'm going to try it 
and see what happens," Discovery! Points! We have been lured by our geeky desire 
to unlock achievements and earn points, and bragging rights are everything. 

(U//FOUO) "Definitely a number of users have gotten into the Skilz points. We have 
several people at level six. They see what the y need to do to earn more points and 
start trying out different things," said^^^H In fact, ECC analysts now have the 
highest average of Skilz points compared to all of the S2 product lines and have 
written the most fingerprints per-capita! Some people say that the potent 
combination of Skilz points, the Circuit Training, and the team of easily-accessible, 
on-site instructors is the secret to ECCs successes with XKS. 



(U//FOUO) Maybe XKS is a seven-headed dragon as 



Imentioned. Dig and 



scary? Sure, Strong and powerful? Oh yeah. But, the ECC is taming it, and it is ours 
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to do with whatever we like, including catching shrimp, 

(U//FOUO) ECC SIGDEV 

* (S//REL) Here are charts to illustrate the point; 
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(TS//SI//NF) PRISM (US-984XN) Based Reporting: 
June 2011 - May 2012 

Sorted By # of PRISM-Based Reports Per OPI 



RISM 



OPI - Top Producers Issuing 


PRISM-Based 

Reports 


% Increase in 
PRISM-Based 
Reports 
Compared to 
June 2010- 
May2Q1 1 


% Of All OPI 
Reporting Which is 
PRISM-Based 


% Points 
Change from 
June 2010 - May 
2011 period 


All Reports By 

OPI 


Single-Source 
to PRISM 


%of PRISM-Based 
Reports Which are 
Single Source 


SCS (F6 1 , US-96*, US-97 1 , US-3219) 


3723 


Up 67% 


20 


+ 7 (up 54%) 


18640 


3040 


82 


S2I - Counterterrorism 


3493 


Up 5% 


42 


-2 (down 5%) 


8242 


2074 


60 


S2E- Middle East & Africa 


2574 


Up 47% 


16 


+2 (up 14%) 


16537 


1959 


76 


S2G - Combating Prolif 


2092 


Up 49% 


30 


+3 (up 11%) 


6872 


1395 


67 


NSAT 


1690 


Up 20% 


30 


+3 {up 11%) 


5713 


1319 


78 


S2A 


| 1389 


Up 8% 


ii 


-1 (down 8%) 


12445 


1196 


86 


NSAG (USJ-800 1 ) 


1255 


Down B% 


11 


0 (no change} 


11741 


883 


70 


ECC (ESOC) (USJ-753 1 , USM-44) 


1147 


Up 6% 


52 


+2 (up 4%) 


2217 


922 


80 


S2C- Inti Sec Issues 


1147 


Up 75% 


13 


+5 (up 63%) 


8989 


861 


75 


S2D- Countering Frgn Intel 


8ffi 


Up 40% 


12 


-5 (down 29%) 


7089 


545 


63 


S2F - Inti Crime & Narc 


666 


Up 41% 


16 


+2 (up 14%) 


4122 


497 


75 


S2B - 


634 


Down 10% 


13 


-3 (down 19%) 


4842 


452 


71 


NTOC (V 1 ) 


455 


Up 237% 


21 


+B (up 62%) 


2195 


355 


78 


DSD 


310 


Down 1 5% 


4 


0 (no change} 


7511 


296 


95 


NSAH (USJ-750 1 ) 


237 


Down 10% 


2 


+1 (up 50%) 


12023 


155 


65 


S2J - Weapons and Space 


225 


Up 221% 


33 


+11 (50%) 


692 


186 


83 


GCHQ 


197 


Up 137% 


2 


+1,9 (up 1900%) 


11257 


170 


86 


S2H 


176 


Up 159% 


— 

5 


+3 (up 150%) 


3353 


155 


B5 


SSG 


16 


Up 60% 


17 


-19 (down 52%) 


92 


14 


88 


Utah Regional Ops Cntr (USJL755) 


12 


Up 20% 


6 


-17 (down 74%) 


207 


12 


100 
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(TS//SE/NF) PRISM (US-984XN) Based Reporting: 
June 2011 - May 2012 

Sorted By % of PRISM-Based Reporting Per OPI 



OPI - Top Producers Issuing 


PRISM-Based 

Reports 


% Increase in 
PRISM-Based 
Reports 
Compared to 
June 2010- 
May2011 


% Of All OPI 
Reporting Which is 
PRISM-Based 


% Points 
Change from 
June 2010 - May 
2011 period 


All Reports By 

OPI 


Single- Source 
to PRISM 


%of PRISM-Based 
Reports Which are 
Single Source 


ECC (ESOC) (USJ-753 1 . USIVM4) 


1147 


Up 6% 


52 


+2 (up 4%) 


2217 


922 


30 


S2I - Counterterrorism 


3493 


Up 5% 


42 


-2 (down 5%) 


8242 


2074 


60 


52J - Weapons and Space 


225 


Up 221% 


33 


+11 (50%) 


692 


136 


33 


S2G - Combating Frol if 


2092 


Up 49% 


30 


+3 (up 11%) 


6372 


1395 


67 


NSAT (USJ-733 1 ) 


1690 


Up 20% 


30 


+3 (up 11%) 


5713 


1319 


73 


MTOC (V 1 ) 


455 


Up 237% 


21 


+5 (up 62%) 


2195 


355 


73 


SCS (F6 1 , US-96\ US-97 1 , US-3219) 


3723 


Up 67% 


20 


+ 7 (up 54%) 


18640 


3040 


32 


SSG 


16 


Up 60% 


17 


-19 (down 52%) 


92 


14 


38 


S2E- Middle Easts. Africa 


2574 


Up 47% 


16 


+2 (up 14%) 


16537 


1959 


76 


S2F - Inti Crime & Narc 


666 


Up 41% 


16 


+2 (up 14%) 


4122 


497 


75 


S2C - int^fe^ssue^^^^^^^^^ 


1147 


Up 75% 


13 


+5 (up 63%) 


3939 


361 


75 


:_L B. ’ 


634 


Down 10% 


13 


-3 (down 19%) 


4342 


452 


71 


S.2D ^ounterinc^™ 


862 


Up 40% 


12 


-5 (down 29%) 


7089 


545 


63 


S2A^ - 


13B9 


Up 5% 


11 


-1 ( down B%) 


12445 


1196 


36 


NSAG (USJ-BOO 1 ) 


1255 


Down 3% 


11 


0 (no change) 


11741 


333 


70 


Utah Regional Ops Cntr (USJ-755) 


12 


Up 20% 


6 


-17 (down 74%) 


207 


12 


100 


52H 


176 


Up 159% 


5 


+3 (up 150%) 


3353 


155 


33 


DSD 


310 


Down 1 5% 


4 


0 (no change) 


7511 


296 


95 


NSAH (USJ-750 1 ) 


237 


Down 10% 


2 


+1 (up 50%) 


12023 


155 


65 


GCKO 


197 


Up 137% 


2 


+1.9 (up 1900%) 


11257 


170 


36 


Source: PLUS - 11-13 June 201 2 
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FAA702 UTT DNI Tasking 

Snapshot on 30 Jan 2013 



Product 

Line 


All DNI 
Selectors 
Tasked 


DNI 

Selectors 
Tas ked to 
SSO CT N 
(FAA/PRIS 
M) 


% of DNI 
Selectors 
Tasked to 
FAA/PRISM 


% Points 
Change 
From Dec 
2011 


Increase in 
number of 
selectors 
tasked to 
FAA/PRISM 
Compared 
to Dec2Q1 1 


S2A 


96 50 


987 


10% 


-5 


+232 


S2B 


12872 


2263 


18% 


+6 


+842 


S2C 


8763 


1059 


12% 


+3 


+468 


S2D 


10846 


3796 


35% 


+11 


+1872 


S2E 


18061 


6935 


38% 


-4 


+938 


S2F 


3577 


1011 


28% 


+2 


+423 


S2G 


12788 


4172 


33% 


+2 


+1019 


S2H 


10497 


828 


8% 


+6 


+660 


S2I 


14945 


11461 


77% 


-1 


+818 


S2J 


1077 


242 


22% 


-2 


-55 


EGG (F22) 


4880 


3523 


72% 


-1 


+715 


FTS 


7194 


2402 


33% 


+9 


+1126 


FTV 


68 


0 


0% 




0 


FGS 


6919 


3114 


45% 


-6 


-17 


FGV 


127 


50 


39% 


+21 


+16 




rism; 



Product Line 


All DNI 
Selectors 
Tasked 


DNI 

Selectors 
Tasked to 
SSO CT 
N 

(FAA/PRIS 

M) 


% of DNI 
Selectors 
Tasked to 
FAA/PRISM 


% Points 
Change 
From Dec 
2011 


Increase in 
number of 
selectors 
tasked to 
FAA/PRISM 
Compared to 
Dec2011 


FHS 


6101 


612 


10% 


-7 


+29 


FGS 


592 


55 


9% 


+7 


+52 


F6 


29476 


4007 


14% 





+1650 


F1Z-CSG 

GENICOM 


105 


3 


3% 


-10 


46 


F74 - MOC 


300 


171 


57% 


-7 


-136 


F7A-AMOC 


417 


6 


1% 


+1 


+6 


F7U - UROC 


926 


27 


3% 





-15 


NTOC - V24 


278 


0 


0% 





0 


NTOC-V25 


30 


17 


57% 


+39 


+16 


NTOC- 

V26/V23 


4237 


2814 


66% 


+4 


+1490 


NTOC-V32 


2388 


12 


1% 


+i 


+11 


NTOC-V35 


15 


0 


0 





0 


SSG 


6609 


0 


0% 


.. 


0 


S32 


1388 


86 


6% 


+i 


+36 



DNR realms excluded from UTT query: MEI, MSI, ituEJ64, Ki. 



Source: UTT Team 
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(Uj Kunning btrategic 
Analytics Affecting Europe 

and Africa 




The overall classification of this briefing is: 
TOP SECRET //COM INT//REL USA, FVEYS//2D291 



Region: Europe, Middle East 
( Israel), and Africa : 

■■■■ ECC 





Outline 



(U) Background 

(U) Problem Definition & Challenge 
(U) Our AOR: Europe - Africa 
(U) Examples for Europe - Africa 
(U) Enrichment and Data Flow 
(U) Real-time, batch, XKEYSCORE 
(U) Conclusions 
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(U) Terrorists Transit via Europe 



NCEUR Support 
to EUCOM 



(U) Communication 

• Transit Points 
(U) Partners 

• Second Party 

• Third Party— 
(U) Relation 
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• AFRIC 

• CENTC 
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(U) Challenge: Integrating Tactical 

& National Collection 

• (C//FVEY) Collection with HF/ 

VHF/UHF 

- Digital packets 

- Analog comms 

- Noise issues, lack of experience with 
these types of signals 

• (C//FVEY) Tactical versus National 
(Strategic) Collection 

- RTRG 

- DISTILLERY 
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(U) Analytics for Targets in Europe 

(C//FVEY) OPSEC Savvy Targets 



• “ . . . most terrorists stop thru Europe 

(TS//FVEY) Use advanced 
techniques 

• Steganography 

• Forensics or Analytics on front end 

• Encryption 

• Takes time and has “black hole” issue 

( TS//SI//FVEY) Reliance on 
“special” collection 

• GCHQ and FAA 

• Problems processing w/r to TS 
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(U) Analytics for Identity 

Intelligence 



(U) Human 
Trafficking 


(C//FVEY) 
Operations 
from Jordan to 
Syria in both 
directions; Sahel 


Metadata for 
geolocation; 
content for 
confirmation 


(U) Weapons 
Smuggling 


(C//FVEY) 
From Libya to 
Sahel 


Metadata for 
geolocation; 
content for 
confirmation 


(U) Drug 
Smuggling 


(C//FVEY) 
Sahel and 
financing of 
terrorism; 
Balkans into 
Europe 


Metadata for 
geolocation; 
content for 
confirmation 


(U) Biometrics 
& Elections 


(C//FVEY) Used 
in Africa 


Need collection 
assets 
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(U) Enrichment Sources 



(U) Air Breather, HF & UHF/VHF 
(C//FVEY) Big Pipe & FORNSAT 
(U) Military SIGINT Services 
(U//FOUO) Forensics 
(U) Third Party Sources 
(C//FVEY) Second Party 

• GCHQ is critical for mission 




QRC Package 




3rd Party Partner Sharing 





\ 


V 


J 




CONFIDENTIAL//REL USA, FVEYS 



Computer Forensics 




(U) Enrichment: SIGDEV & GCHQ QFDs 



• (S//FVEY) 54% of current ECC DNI 
tasking based on QFD data 

• (S//FVEY) QFDs provide better 
access to metadata for European & 
North African targets than any other 
access at ECC due to poor passive 
collection 

• ( C//FVEY) Flexibility provided by 
the use of TDIs and the first stage 
query allows for better target 
discovery and development 



Slide taken from ECC archives. 



f 


\ 


V 


J 



Account Allocations by TOPI 

S2A S2B S2C S2D 




March 2012 
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(U) Data Flow Integration is Constant Headache 



Access 



Exploitation 



Signal 




Signal 




Receiver/ 


Acquisition (RE 




Conditioning: 




Downconverter 


or Optical) 




Amplification, 

Distribution 




(RF) 







Target Development 



Target Tasking 






Transport 



Data Mgmt 

Events 






Transition to 
the CLOUD 



Selectors 



Translation/ 

Transcription 




Intelligence Reporting 




Voice/fax/data files 
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(U) “Real Time” Analytics 




(U) Nascent Analytics with unclear definition of “real 
time” 

• How fast is alerting? 

(C//FVEY) DISTILLERY 

• Pulled from GHOSTMACHINE stack 
(U) NIAGARAFILES 

• File based 

• Starting to gain experience 
(C//FVEY) RTRG 

• Tools not integrated into ECC 

• Data Sets are sparse 

• Tactically oriented 

• Unregulated alerts can quickly spam user 
(C//FVEY) ECC Current Effort: 

• Focused on NTOC and Distributed Denial of 

Service attack alerting 
TTc^g rn^TTT T FRY 
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(U) Batch: MapReduce Analytics 




(U) Batch oriented versus streaming 

• Run every 1 5 min to once a day or so 

• Not streaming 
(U) Good Data Storage 

• Good access outward to MDR-1, MDR-2 

• Days to years of storage 

• Promotion (?) 

(U) Complex Analytics like “Pattern of Life” 

• Reasonable amount of processing cycles at the 
front end collection system (not yet tested) 

(U) Session can be quite long and still captured (not yet 
tested) 

(U) UUID’s (identifying sessions) are workable 
(U) No experience yet sharing with second and third 
party partners 

(U) Unknown level of entry training required 
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(U) Xkeyscore Fingerprints 




(C//FVEY) Streaming 

• Data available one hour later? 

• Most do pulls up to yesterday 
(U) Good Data Storage 

• RAW content: 3 days to a couple of weeks 

• Metadata: 90+ days 

(U) Complex Analytics like “Pattern of Life” 

• Reasonable amount of processing cycles at the 
front end collection system 

(U) Session can be quite long and still captured 
(U) UUID’s are workable 

(U) Good for sharing with second and third party 
(U) Relatively low level of entry training required 
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(U) Key Take Aways 



(U//FOUO) Discovery in Africa is based on “we 
do not know what we do not see” 

- Unknown Unknown from url: https://wiki.nsa.ic.gov/ 
wiki/NTOC-E_discovery_tradecraft 

(U) Europe has Opsec savvy CT targets 

(U) Analytics involve partners 

-- 3rd Party in future 

(U) Limited Resources: Processing Power & BW 
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NSA/CSS Europe & Africa 




QUESTIONS? 
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(U//FOUO>SIDAroundtlie World: The Rheinland 

FROM 

Unknown 

Run Date: 09/16/2003 

(S//SI) Having served on one field tour at NO EUR, 
Stuttgart, Germany, in the mid-1990s, I was once again 
fortunate to get an offer for another field assignment in 
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Germany just two years later, at NSA's European 
Technical Center (ETC) in Wiesbaden, The position at ETC 
was as a Foreign Relations Staff Officer, responsible for 
coordinating technical support to NSA's Third Party 
partners in Europe and the Middle East, My wife served 
as NSA's liaison to the Army's 66th Military Intelligence 
Group in Darmstadt, We lived between Wiesbaden and 
Darmstadt, due south of Frankfurt, and our school-age 
children went to the DoDDs school in Darmstadt, 

(S//SI) For a career Intelligence and Language Analyst, 
the most interesting and rewarding aspects of working at 
ETC were exposure to the engineering work that NSA 
does and to the superb group of people who carry it out. 

It was a pleasure, indeed, even an inspiration, to deal with 
the technical personnel who put SIGINT and related 
systems in place, to witness their expertise, and to gain 
greater awareness of technical support, maintenance, and 
logistics problems. The engineering and logistics friends I 
made in Wiesbaden are ones I would likely not have met 
in my regular career field back home, and I learned a lot 
from them. Supporting NSA's foreign partnerships and 
sometimes dealing directly with foreign partners was a 
particularly interesting experience as well, 

(U) Outside of work, the most rewarding aspect of living 
in the Rheinland area of Germany is the opportunity to 
travel across Germany and much of Europe, France, the 
Benelux countries, and Switzerland are all within a few 
hours' drive, for a weekend or, for border destinations 
such as Strasbourg, even a day trip. For longer drives, 
Paris and Berlin are within six hours drive, the Alps are 
3-7 hours away, depending on which mountain is being 
sought, and other destinations - in southern France, the 
Czech Republic, Austria, Hungary, Slovenia, Croatia, and 
Italy - are within reasonable long-distance reach for an 
extended vacation. Living near Frankfurt also puts one 
very close to rail and air connections to anywhere in 
Europe, including low-cost air travel to many European 
destinations. It was a thrill to be able to visit sites of 
historical and cultural significance during our tour, and 
living in Germany has marked our children with a 
considerable appreciation for European history and 
culture. 

(U) The middle Rhein area between Mainz/Wiesbaden and 
Koblenz is quite scenic and offers many opportunities to 
sample aspects of German life, especially gastronomic 
pleasures, closer to home. You don't have to go far to find 
a really good white wine, for some very good Rieslings 
may well be just down the street, Wiesbaden is located 
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within the Rheingau wine area; the Rheinhessen is just 
across the Rhein, and the Rheinpfaltz (Rheinland 
Palatinate) and Mosel-Saar-Ruwer regions, as well as the 
French province of Alsace, are close by. Even 
lesser-known wine regions, like Franconia, are within 
reach, 

(U) As for cuisine, eating in Germany can be a real 
pleasure for all but the most conservative tastes, I have 
not had a bad German meal yet. Local specialties abound; 
in the Rhein/Main plain closer to Darmstadt, the Germans 
grow the sweet, white asparagus ("Spar gel") that is 
harvested in May and enjoyed throughout Germany, The 
strawberry season follows immediately thereafter, 

(U//FOUO) It might belabor the obvious that I enjoyed 
living in Germany to no end. Working and living in the 
field is a great experience, and working at ETC and living 
in Germany was no exception. I'd do it again. 
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(U//FOUO) First- Ever Formal SIGINT Development 
(SIGDEV) Train mg Is Provided to SIGINT Seniors 
Europe (SSEUR) Partners 

FROM: SIGDEV Strategy and Governance, Governance & 
Community Engagement (SSG GCE), 

Associate Directorate for Education and Training (ADET), 
and NSA's Foreign Affairs Directorate (FAD) 

Run Date; 10/25/2010 
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(U//FOUO) History has been made: for the first time ever 
SID, AD EX and FAD personnel collaborated to create an 
analytic course for NSA Third Party partners, 
“Introduction to SIGDEV" was held at the European 
Technical Center (ETC) in Wiesbaden, Germany, and 
taught to 26 students from SSEUR nations,* 14-16 
September 2010, 

(S//REL) The course provided the SSEUR partners with 
a common understanding of the importance of SIGINT 
Development (SIGDEV) as a discipline, and a common 
definition of SIGDEV efforts. This effort enhanced the 
opportunities for SSEUR partners to work together more 
effectively to tackle mission areas of mutual interest -- 
especially Afghanistan and Counterterrorism (CT) target 
sets. 



(U//FOUO) The training was extremely successful, based 
on survey responses, and many of the partners plan to 
incorporate information from this course into training 
programs for their own new SIGINT analysts. 

(U//FOUO) SID, ADET, and FAD are currently creating 
another more in-depth telephony analysis training course 
with the hopes of presenting this training to NSA Third 
Party partners in spring/summer 2011. 

(U//FOUO) For more information on SSG Governance & 
Community Engagement, visit SSG Governance & 
Commit (go ssg-gce), 

(U//FOUO) For more information on the Associate 
Directorate for Education and Training, visit AD ET 
Website (“go adet"). 



(U//FOUO) For more information on the Foreign Affairs 
Directorate, visit FAD Website (“oo faks"). 




(U) Notes: 

* (S//SI//REL) SSEUR members are the Five Eyes nations 
(Australia, Canada, New Zealand, United Kingdom and 
United States) and the following Third Party partners: 
Belgium, Denmark, France, Germany, Italy, Netherlands, 
Norway, Spain, Sweden, All Third Party nations in SSEUR 
sent students to the training, as did the UK, 
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(C//REL) NSA Communications Hub in Europe Is Modernized 

FROM: (U//F0U0||HHil 
Director, European Technical Center (F25) 

Run Date: 10/20/2011 



(C//REL) Introduction: The European Technical Center (ETC) in Wiesbaden, 
Germany, is NSA's primary communications hub in that part of the world, providing 
communications connectivity, SIGINT collection, and data-flow services to NSAers, 
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warfighters and foreign partners in Europe, Africa, and the Middle East, That's why 
it is essential that ETCs capabilities keep up with the demand,, . 



(C//REL) On 19 September, NSA officials* proudly hosted a ribbon-cutting 
ceremony to officially mark the completion of GODLIKELESION - ETCs 
Communications Center modernization project. The project initially began as a 
limited effort to address challenges in cooling, equipment configuration, cable 
management, and space in the room. Over time the effort grew into a much 
broader joint project to completely rebuild the room from the ground up into a 
state-of-the-art communications center. 



ETC ribbon cutting 



(C//REL) Many years of high operations tempo and expansion had resulted in 
incorrect rack configurations, poor airflow, insufficient rack size, installation 
shortcuts, substandard safety and security measures, inconsistent cable 
management, and lackluster documentation. In early 2010, over 150 power 
supplies failed over several months, spurring an agreement between NSA's I&L, 
Technology Directorate and ETC leadership to expand the scope of the 
GODLIKELESION project to include a new supporting power infrastructure, 

(C//REL) The GODLIKELESION project was completed in seven phases, all without 
any interruption to the mission data flowing through ETC, Work alternated 
between Enterprise IT Services (T3) and I&L elements to replace legacy flooring 
and equipment racks; close partnering among the organizations allowed for timely 
completion of the various phased tasks. As an example, all equipment supporting 
communications for 27 Third Party partner dataflows was moved, re-installed and 
documented within 12 days. 



(U//FOUO) The work completed by I&L included new Uninterrupted Power Supply 
(UPS), UPS distribution system, grounding system, raised access floor, rack power 
distribution elements (PDE), and computer room air-conditioner (CRAC) units and 
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condensation piping, ETC partnered with T32 personnel to remove SI legacy racks, 
install 89 new equipment racks, move 253 pieces of equipment, install 5,668 feet of 
new fiber, and create 1,076 pages of documentation. The new racks represent a 
670% increase in available equipment space with cooling capacity doubled from 
2009 conditions. The newly outfitted space will provide reliable and robust IT, 
communications, and data- transport services for the foreseeable future. 



(U) Notes: 



* (U//FOUO) Hosting the event were I 
TechnictUC enter, together with | 
mm Director, Technology Di rectorate; Mr. I 
Director for Data Acquisition; and 
Facilities Services, 



iDirector of the Eurot 
Chief, NC EUR; | 

| Assistant Deputy 
I Chief, Installations and 
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(UffFQUO) TEC Successfully Installs BOTANICREALTY at LADYLOVE (USJ-799) 




(TS//SI//REL) In response to a request from S2B, MSGC System Development and 
Signals Development Lab personnel collaborated with the TEC to deploy a solution to 
collect a video network. When first detected, the video was unencrypted. The 
video therHJecame encrypted over a period of two months. The current demodulation 
solution from the TEC is called BOTANICREALTY. Originally, SALTYDOGS was used 
to find carrier acquisitions and discover signal characteristics. This provided the 
frequency range, carrier rates, and a rough time up and time down for channel activity. 



(TS//SI//REL) In mid-April, the TEC installed BOTANICREALTY (formerly kno wn as 
UNCANNY) at LADYLOVE in the hopes of locating, identifying, and collec ting | 

|clear and encrypted video signals found on the] 

The collection of these signals, in support of~ 
important to the various 

special projects at the CIA, and in general product reporting | 





(TS//SI//REL) Within minutes of the system coming on line, BOTANICREALTY 
successfully c ollect ed its first signal matching the parameters of the encrypted (HIGH 
PRIDE) video The hub control channels are session encrypted while the 
outstations are bulk encrypted video. Since proving the ability to automatically process 
these signals of interest at LADYLOVE, over 1000 collects, totaling hundreds of hours 
of raw data, have been made and forwarded to cryptanalytic personnel in CES for 
further investigation. 



(UffFQUO) Joint SIGINT Activity Annual Report for 2007 




(S//SI//REL) The Joint SIGINT Activity (JSA) experienced notable successes in its 
FORNSAT mission during 2007 for NSA and the German Federal Intelligence Service, 
or Bundesnachrichtendienst (BND). However, concurrent with the JSA mission 
changes, manpower requirements were re-evaluated and reductions to both civilian and 
contractor manning levels were approved with implementation to be carried out in FY08. 

(S//SI//REL) The past year also saw an expansion of JSA’s partnerships with SSO, 
TOPIs, and ESOC, with plans to expand these further and increase support on various 
operations in 2008. JSA will continue to build on its successes and improve its mission 
contribution in collection and SIGINT development to both NSA and BND. 
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(U//FOUO) Highlights for 2007: 

(S// SI //REL) JSA engineers developed various analysis tools and an automated selector 
sanitizing tool. The selector sanitization tool can be used at other sites, including those 
working special projects. 

(S// SI //REL) The expansion of site capabilities through the installation and integration of 
U S. and German systems significantly improved collection and development of high- 
priority targets. New or improved capabilities include an automated survey system, VoIP 
processing and metadata collection capabilities, a high speed filtering system, GSM 
metadata collection capabilities, and new data flows to NSA for DNI, VoIP and GSM 
metadata. 

(S//SI//REL) A closer relationship between ESOC, JSA and BND resulted in new 
exploitation of targets in Algeria as well as other African targets. New TROPICPUMA 
fax processing capabilities deployed in Decembenmmediatel^eaarU^)rovide unique 
and valuable intelligence to ESOC and BND on 

(S//SI//REL) The BND used JSA GSM collection to identify, track, alert, and 



S//SI£REUJSAcontinues to provide critical collection of the 

network, providing unique insights into 



(S//SI//REL) NSA personnel continued to improve BND’s skills through both classroom 
and on-the-job training allowing BND personnel to take on greater roles in DNI 
processingandanalysis. 



(S//SI//REL) Joint SIGINT Activity-Developed VolPSum and AutoNorm Tools Used 
in Local Analysis, Create Agency-wide Interest 




(S//SI//REL) JSA has developed and is now using two new number normalization tools 
- a VoIP Summarization (VolPSum) tool and an Automated Normalization (AutoNorm) 
tool. 

(S//SI//REL) Voice-over-IP (VoIP) traffic is prevalent at many collection sites, including 
JSA. Site engineers have developed a simple tool, called VolPSum, to extract, parse, 
and organize VoIP metadata for analysis by Intelligence Analysts, Signals Analysts, and 
developers. VolPSum provides the user with several outputs: a summary file of 
cities/countries on each case notation seen in its run , also viewable by web browser; a 
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file containing UR Is (Uniform Resource Indicators) and their associated IP addresses; a 
file of normalized numbers and location information; and a file of normalization 
suggestions for non-normalized numbers, generated with help from AutoNorm. 

(S//SI//REL) Generating normalization rules for NORMALRUN can be very difficult 
without adequate knowledge of a region’s Country Code (CC), National Destination 
Code (NDC), Local Exchange Office Code (LEOC), and Subscriber Number (SN). JSA 
has found their in-house developed tool, AutoNorm, a great time saver for generating 
NORMALRUN rules. AutoNorm works by matching substring combinations of the raw 
number against the Global Numbering Database flat file. It provides several input 
options: generic, which tries to find an exact match; prelist, which appends a given set 
of digits to domestic calls before attempting matches; and sort, which sorts its output 
into groups that share the same digits stripped or pre- pended. 

(S//SI//REL) These two tools have been used by JSA analysts to aid in generating 
reports and number normalizations and target research. Additionally, representatives 
from the NAC, Misawa, SSG, S2C, and SSO have expressed interest in receiving and 
using VolPSum and AutoNorm. 

(S//SI//REL) VolPSum and AutoNorm are now available for download! For more 
information, including user manuals, output examples, and a downloadable tarball, 
please visit JSA’s website . You may also contact the PGCs listed above. 



(S//SI//REL) Joint SIGINT Activity Begins New SMS and Call Event Dataflows for 

NSA Analysts 




(S//SI//REL) JSA initiated two new SMS dataflows for NSA analysts in April. These new 
dataflows are from USD-1 079’s AST128B and AST128C DNR collection platforms. The 
SMS data is flowing into D I SHF I RE, and the corresponding call event data into FASCIA. 
A cursory look at dialing showed 

Poland and others. Preliminary data shows that JSA is sending over 330,000 SMS 
events to DISH FIRE daily. So, let the hunt begin! One can isolate this new SMS data by 
querying in DISHFIRE on JSA’s PDDG (IQ) and collection box (RA, LI), This SMS 
collection is being processed on multiple case notations from INTELSAT- 902 (G2), 
YAMA^02 (E9), and EUTELSAT-W6 (KL) with forward and reverse gateways with 
(primarily). However, we also have Tajikistan, Russia, Monaco, Lebanon 
and UAE gateways represented. As a reminder, JSA has been forwarding SMS data 
from its JUGGERNAUT GSM collection platform since 2007. 




— Der Zeitgeist - 

(C J Joint SIGtNT Activity (JSA) 
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(S//SI//REL) US, German SIGINTers Increase Cooperation on African 
Targets 

FROM: (S//SI//REL) HHHHH 

SIGDEV Analyst, Joi^^^^^^^^uvity (II52GI) 

Run Date: 12/13/2007 

(S//SI//REL) The ]SA * is a joint US -German SIGDEV operation conducted from a 
German SIGINT facility. It has been filling collection gaps for the US -run European 
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Security Operations Center's (ESOC) counterterrorism effort, as well as other 
African missions, for over a year now**. So far in 2007, NSA has produced thirteen 
Africa-related SIGINT reports from JS A collection, a success which has opened the 
door to greater cooperation at JSA on the African target set.. 



( S//SI//REL ) Ma ng fall Kaseme in Bavaria, home to JSA. 

(S//S I//REL) ESOC and JSA: A Logical Match 

(S//SI//REL) Due to higher priority ongoing tasks for Iraq and Afghanistan, ESOC 
(see backgro und) has had difficulty in getting collection resources to survey for 
African signals. As a result, ESOC has been investigating possible Third Party 
relationships to leverage partner accesses and linguistic capabilities, DND is both a 
trusted partner and a very modem and capable SIGINT service, which lessens 
concerns about sharing capabilities and SIGINT selectors with this partner as 
opposed to other potential African partners, JSA's collection resources, as well as 
BND's overlapping requirements regarding North Africa, made JSA an obvious 
choice to quickly respond to ESOC's SIGDEV requirements, 

(S//SI//REL) JSA Collects Against Africa 

(S//SI//REL) In fall of 2006, JSA began collecting email traffic related to 
GSM infrastructure, producing a number of SIGDEV- related reports. Then in the 
summer of 2007, ESOC requested that JSA perform a survey of six satellites in 
search of specific North African communications. During the course of the survey, 
JSA located and initiated collection on^^^^^|GSM signals carrying 
communications. In October 2007, ESOC issued its first CT SIGINT report from 
JSA's GSM (Global System for Mobile communications) collection. In addition to 
supporting ESOC, JSA is now collecting signals in support of 
NSAW's CT mission, 

(U) Overlapping Requirements 

(S//SI//REL) NSA and DND have similar SIGINT requirements regarding Africa. 
DND has standing intelligence requirements for various political and humanitarian 
issues throughout Africa, DND's current priorities in Africa are Sudan, Algeria, and 
Somalia, In Sudan, DND is collecting two different GSM networks at another 
FORNSAT facility, and using the metadata to track targets, Germany is very 
interested in the peace process in Darfur and southern Sudan, Regarding Algeria, 
DND has been processing border guard communications from JSA collection, but 
these signals appear to be migrating to a new data network, requiring a new 
processing capability, DND IIQs analysts are eagerly awaiting a processing solution 
in order to more fully exploit these internal Algerian communications. For Somalia, 
Germany has forces in the Horn of Africa region supporting Operation Enduring 
Freedom, and is very interested in the political and humanitarian issues 
surrounding Somalia, 

(U) Future 

(S//SI//REL) NSA analysts at JSA are working with CSRC (Collection Strategies and 
Requirements C enter )-Europe and NS A/CSS Representative AFRICOM to explore 
new areas where JSA can support overlapping African SIGINT requirements from 
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NSA and DND. 



(U) Notes: 

* (S//SI//REL) "JSA" stands for "Joint SIGINT Activity," It is operated by NSA and 
the Bundesnachrichtendienst (BND ■ German Foreign Intelligence Service) at the 
German SIGINT facility Mangfall Kaserne in Bavaria, Any association of NSA with 
Man g fall Kaserne is SECRET//COMINT//REL TO USA, FVEY. 
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JSA Restrictions 



Access 

Central: 

Targeting 

Targeting and selector 

□ ACLogoRed.png management are services 

that Access C entral 
offers . This incorporates 
the configuration , 
d eliv e ry , and exchange 
of targeting as well its 
optimisation , assurance , 
and enrichment . For 
more about the services 
that A c c e s s Centre/ 
o ffe rs visit Services 



[edit] General 

JSA is a US/German COMSAT Site which although provides a unigue 
access has several restrictions on what can be targeted. The broad 
restrictions can be defined as: 

1 . No German or 5 Eyes nationality or location 

2 . No European Economic Targeting 
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3. 5 Eyes/No Eyes Only 

4. No Unknown Nationality/Location 

[edit] Domains 



We have been advised that the following domains are not accepted atJSA 
to avoid any sensitive nationality selectors being targeted, a full list of 
country codes is available here 

* .as 

■ .at 

* .au 

* .ca 
» .de 

* -gu 

* m P 

■ .nz 

* -pr 

* .uk 
» .us 

* .vi 

[edit] Companies/Entities 

This is a list that we received from JSA stating address that should not be 
targeted due to them being German companies or entities 

* BASF.COM 

* BAUMARKTFORSCHUNG.COM 

* BOEHmNGER-lNGELHElM.COM 

* BRANDST1FTER.COM 

* BUNDESWEHR.ORG 

* CLEARSTREAM.COM 

* DEB1TEL.NET 

* DEUTSCHE-BANK 

* DHL.COM 

* EADS.NET 

* EUROCOPTER.COM 

* FEUERWEHR-lNGOLSTADT.ORG 

* HANAFOS.COM 

* HERRENKNECHT 

* KL1MAWANDEL.COM 

* MERCEDES-BENZ.COM 

* MTU-NET.RU 

* MUN1CH.ORG 

* NDSATCOM.COM 
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• NEUE-EINHEIT.COM 

• ORGELBAU.COM 

• PAETZOLD.COM 

• ROHDE-SCHWARZ.COM 

• SACHERGMBH.COM 

• SENIORENHEIM.COM 

• SIEMENS.COM 

• SIEMENS-AFGHANISTAN.COM 

• TESSAGIFLAN.COM 

• VS -HYDRO. COM 

• 

• ^^^^^^■a-HOTMAIL.COM 
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(S//SI) German, NSA SIGINTers Share DNI Processing Knowledge 

SUSLAG (Special US Liaison Activity Germany) 

Run Date: 05/22/2006 

(S//SI) A BND* delegation responsible for building BND's next generation DNI 
(Digital Network Intelligence)- processing architecture visited the Joint SIGINT 
Activity (JSA) in late February for two days of discussions to learn more about 
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NSA's DNI architecture. The JSA, an operational element of the Special US Liaison 
Activity Germany (S US LAG), is a joint SIGINT development, collection, and 
exploitation site manned by German and US personnel, 

(S//SI) DND analysts discussed their processing architecture, which is largely 
based on NSA's old P25 and P26 GRANDMASTER prototypes, Their focus is 
primarily e-mail processing, specifically SMTP e-mail. Spam Alters are used to 
manage large data volumes. Selected traffic is passed through an automated 
privacy protection system, ensuring that analysts cannot view German -protected 
traffic. On-site DND analysts then manually assess all selected traffic to determine 
potential intelligence value. 

(S//SI) In conducting this evaluation, they do not prioritize the selected traffic by 
target or keyword. Instead they focus on e-mails carrying attachments with the 
goal to scan e-mails as quickly as possible to increase their throughput. E-mails 
that are determined to be of potential intelligence value are then forwarded to DND 
IIQS for follow-on evaluation and reporting, 

(S//SI) NSA intelligence analysts discussed NSA's SIGINT Development model, 
NSA's "Hunt versus Gather" philosophy, our multi-stage selection and Altering 
process, and the evolution of DNI processing systems from GRANDMASTER to 
WEALTI I YC LUSTER and, in the future, TURMOIL , The DND appeared especially 
interested in the TURMOIL approach of scanning and making judgments at the 
packet level prior to any sessionizing, 

(S//SI) In summary, NSA and BND use opposite selection and filtering 

approaches. Where NSA primarily relies on equipment for selection (e,g, 

DLAC KNIGHT) and analyst minimization for privacy protection, the DND relies on 
analysts to manually scan traffic for selection, and then equipment to Alter data for 
privacy protection. Full use of current NSA DNI processing systems and analysis 
methodologies at JSA will be key to influencing the DND to alter their strategic DNI 
processing approach, 

*(U) Note: DND = Germany's Dundesnachrichtendienst (the Federal Intelligence 
Service) 



(U) This article is reprinted from the Foreign Affairs Digest, April edition. 
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Human Language 

Technology 
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Center for Content Extraction 



Content Extraction Analytics 

SIGDEV End-to-End Demo 




21 May 2009 



Derived From: NSA/CSSM 1-52 
Dated: 200701 08 
Declassify On: 20330108 
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Introduction to Content Extraction 



■ New technologies can find Essential 
Elements of Information in documents 



■ The Center for Content Extraction provides 
"one stop shopping" for these technologies 
at NSA 
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Extraction can benefit SIGDEV from end to end 



■ Selection 

■ Translation & Transliteration 

■ Analysis 

■ Interpretation/Enrichment 

■ Retrieval 

■ Storage & Distribution 
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STAIRS Partners 



S (Marina, CEA) 

T (Cybertrans) 

A (SNA/Paintball, Synapse) 

I (Nymrod, Thundercloud) 

R (Journeyman/CPE) 

S (GoldenRetriever; Sociopath) 
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Implementation: CCE Extraction Architecture (LexHound) 



Subscription Based 
Customers - extracted 
report/ transcript content 

Marina (com m s tracki n g ) 
Synapse/EKS (link analysis) 
Nymrod (Name Matching) 



Web Service 
On 

Demand 

Customers 



Wei 



Web Services 

LexHound Web Demo 
CAMT (translation) 

TKB (target knowledge base) 

SNA (social network analysis) 

GIS (geo mapping) 

NTOC (terror cell tracking) 

Heresy itch (UC collateral) 

Go Id en Retrieve r (record building) 



Reports 
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Elaboration: The Central Importance of Storage 

□ Each of the STAIRS Steps exploits 
stored information 

■ Selection Dictionaries ("get it") 

■ Linguistic Glossaries for Translation 

■ Wikis etc for enrichment ("know it") 

□ Manual record-formation is slow, prone 
to omissions and inconsistencies 

■ <200K Person Targets in TKB 

■ Growth ~= 2 OK/year 

□ Automatic extraction accelerates storage 

■ >3000K Citation Records in Nymrod Entity DB 

■ Growth ~= lOOOK/year 
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Machine vs. Manual Chief-of-State Citations 





Nytnrod (machine-extracted) Citations 




Last TKB 




Name 


Role 


Cod 

a 


Cites 


Manual 

Update 


1 


Abdullah Badawi 


Malaysian Prime 
Minister 


COS 


> 100 


10/15/200 

7 


2 


Abdullahi Yusuf 


Somali President 


cos 


> 300 


N/A 


3 


Abu Mazin 


(Mahmud Abbas) PA 
President 


cos 


> 200 


5/20/2009 


4 


Alan Garcia 


Peruvian President 


cos 


> 100 


N/A 


5 


Aleksandr Lukashenko 


Belarusian President 


cos 


> 50 


N/A 


6 


Alvaro Colom 


Guatemalan President 


cos 


> 200 


N/A 


7 


Alvaro Uribe 


Colombian President 


cos 


> 700 


N/A 


8 


Amadou Toumani Toure 


Malian President 


cos 


> 50 


N/A 


9 


Angela Merkel 


German Chancellor 


cos 


> 300 


N/A 


10 


Bashar al-Asad 


Syrian President 


cos 


> ftOO 


N/A 


122 


Yuliya Tymoshenko 


Ukrainian Prime 


cos 


> 200 


N/A 
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(C//REL) TEMPORA -- "The World s Largest XKEYSCORE" - Is Now 
Available to Qualified NSA Users 

FROM: (U//FOUO)i^^H^^^^H 
NSA Integree at GCIIQ 
Run Date: 09/19/2012 



(U//FOUO) SIGINT analysts: We have all heard about Big Data; now you can get 
Big Access to Big Data, 
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(TS//SI//REL) What happens when one site contains more data than all other 
XKEYS CORE s combined? At more than 10 times larger than the next biggest 
XKEYSCORE * TEMPORA at GCHO is the world's largest XKEYS CO RE and the 
NSA workforce is now getting greater access to it. This massive site uses over 1000 
machines to process and make available to analysts more than 40 billion pieces of 
content a day. And starting today skilled NSA XKEYSCORE users can get access to 
the TEMPORA database via the XKS -Central interface, 

(TS//SI//REL) What is TEMPORA? TEMPORA is GCIIQ's XKEYSCORE "Internet 
buffer " which exploits the most valuable Internet links available to GCIIQ. 
TEMPORA provides a powerful discovery capability against Middle East, North 
African and European target sets (among others). Analysts who have benefited 
from GCIIQ Special Source accesses like INCENSER or MUSCULAR will almost 
certainly benefit from TEMPORA, 

(TS//SI//REL) How valuable is TEMPORA? The value and utility of TEMPORA 
were proven early into a 5- month evaluation that began this past March, With a 
limited user base of 300 analysts, TEMPORA became the second most valuable 
XKEYSCORE access for discovery. Additionally, this small group of analysts 
produced over 200 end-product reports and provided critical support to SIGINT, 
defensive, and cyber mission elements, 

(TS//SI//REL) Why TEMPORA? TEMPORA provides the ability to do content-based 
discovery and development across a large array of high-priority signals. Similar to 
other XKEYSCORE deployments, TEMPORA effectively "slows down" a large chunk 
of Internet data, providing analysts with three working days to use the surgical 
toolkit of the GENESIS language to discover data that otherwise would have been 
missed, This tra decraft of content-based discovery using the GENESIS language 
is a critical tool in the analyst's discovery tool kit, and nicely complements the 
existing and well-known tradecrafts of strong selection targeting and bulk 
meta-data analysis, 

(TS//SI//REL) How do I get an account? To comply with GCIIQ policy and to 
ensure users are successful in such a large-scale environment, TEMPORA access 
reguires users to be proficient with XKEYSCORE, At NSA this is achieved via the 
completion of various XKS Skilz achievements. Beginning today, users will see a 
new "TEMPORA" achievement, which reguires users to have remained current with 
their UK Legalities training (OVSC1700), be a level 3 or higher XKS Skilz user, and 
have used GENESIS by either querying or authoring fingerprints. Users who meet 
those criteria will automatically be given TEMPORA access in their XKS Central 
account. 

(S//SI//REL) What do I need to know about using TEMPORA? Although 
TEMPORA will appear as an additional database in XKS Central, there are some 
important items analysts need to be aware of when they search this database. 
Analysts are asked to pay close attention to details concerning the UK Legality 
requirements on the TEMPORA user-guidance wiki nacre , TEMPORA queries must 
comply with both UK and U,S, legal requirements, and the analytic community 
must ensure we are using this access wisely and compliantly. 
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(S//SI//REL) How can I learn more about using XKEYSCORE? If you'd like to 
get TEMPORA access but need some help fulfilling the proficiency requirements, 
the XKEYSCORE Outreach Team is ready to help. The team recently added an 
additional round of XKEYSCORE training sessions on ERS, which users can sign up 
for via this link . Also, analysts can find great trade craft and training tips via the 
XKEYBLOG , or they can contact the team directly at DL XKS Mentoring, 

(U//FQUQ) For more information "go TEMPORA" or contact^^^^^^^^^^^^^l 



(U) Notes: 

* (S//SI/REL) XKEYSCORE is a computer -network exploitation system that 
combines high-speed filtering with SIGDEV XKEYSCORE performs filtering and 
selection to enable analysts to quickly find information they need based on what 
they already know, but it also performs SIGDEV functions such as target 
development to allow analysts to discover new sources of information. 
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(S//SI) Forward Production at NCEUR — Inside the Customers" Decision 

Space 

FROM; Customer Account Manager for EUCOM (SI 12) and NCEUR 

staff 

Unknown 

Run Date; 01/14/2005 

Analytic team working at NSA/CSS Europe; success stoiy with Global War on 
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Terrorism (GWOT) (S//SI) 



(S//SI) In early 2003, NSA/CSS Europe (NCEUR) and the Geospatial Exploitation 
and Counterterrorism Product Lines initiated a Forward Production effort (at 
NCEUR) to support our national goals and strategy in North Africa, Among those 
goals was to enable African governments to police their own borders, sustain or 
enhance stability, and make it clear that their countries were an environment 
hostile to terrorist organizations and their supporters, 

(S//SI) This small investment of five -to -six analysts has provided a significant 
return: Forward Production and headquarters analysts* * were able to report the 
predicted movement 

EUCOM Senior Staff and U.S. Ambassadors in the region used this information to 
engage and enable regional governments to conduct successful counterterrorism 
operations. Intelligence generated by this Forward Production-NSAW partnership 
has been responsible for the capture or kill of over 40 terrorists and has helped 
achieve GWOT and regional policy successes in Africa, 

(S//SI) While based on the skills of the forward- deployed analysts as supported by 
NSA I IQ, two other overarching factors contributed to the effort's success. These 
factors are: 

* collocation with the primary regional implementer or action arm of the US 
Government as well as supporting elements, and 

* an aggressive effort to release SIGINTto foreign governments supporting 
truly non-traditional customers (e,g., governments in Algeria, Mali, and 
Mauritania), 

(S//SI) Forward Production's effectiveness is based on collocation and integration 
with operational planners and teaming with all-source customers and partners. 

This allows Forward Production analysts to better anticipate requirements, to 
provide better-tailored products and services, to better operate in the customers' 
decision cycle, and to better understand customer needs, 

(S//SI) As the title of DIRgram-337 states "It's About Relating, Not Disseminating" 
and NCEUR forward- deployed analysts as "our expeditionary force inside our 
customers' information space,,," are better enabling CT operations and reaching 
analytic conclusions not otherwise possible. The Forward Production cell at NCEUR 
is serving as a model for operational partnering and analytic collaboration within 
the customer's environment, 

(S//SI) This Forward Production model will be implemented on an industrial scale 
when the European Security Center (ESC) in Darmstadt, Germany, becomes fully 
operational. The ESC is the realization of a significant investment by US Army 
Europe (USAREUR) and Intelligence and Security Command (INSCOM) to perform 
SIGINT analysis and production against national, theater, and tactical requirements 
within the customer domain, (See related story ,) 



Notes: 

* (S//SI) Extended enterprise and I IQ communities of the GEO, CT, Regional 
Targets, and Middle East North Africa product lines collaborated on this target. 
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(U//FOUO) On the Road Again: SID Team. Visits Germany 

FROM: 

Assistant Deputy Director for Analysis & Production (S2) 

Run Date: 02/01/2006 



(U//FOUO) After staying around headquarters for the last quarter, it was time for 
me to get out and about into the extended enterprise! In early January I joined a 
SID team on a trip to Germany to gain insight into the operations there and to 
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update the NSA/CSS Europe workforce on Agency, SID and S2 initiatives. Our team 
consisted of: 



■ SID Chief of Staff; 

I SID CoS Executive Assistant; 

Deputy Technical Director; 

^^/DDAP Executive Assistant; and 

A/D DAP and Senior Intelligence Authority), 

(U//FOUO) We visited elements of the European Command (EUCOM) headquarters 
and NSA/CSS Europe (NCEUR) near Stuttgart, Germany; the European Security 
Center (ESC) fn Darmstadt; and the European Technical Centei^ET^Mi^^^ 

Wiesbaden, (See a .) Chief, NCEUR. 

accompanied us throughout, 

Stuttgart: European Command HQ and NSA/CSS Europe (U//FOUO) 

(U//FOUO) We arrived in Stuttgart on Monday, 9 January, To stave off the jet lag, 
we walked around downtown Stuttgart until meeting up with a group of NCEUR 
folks for a dinner of good German food. 



(C) On Tuesday morning we were treated to several briefings on EUCOM and 
NCEUR^^^^^^and met with the EUCOM J3 (Director of Operations), Rear 
Admiral ^^^^pnd EUCOM J2 (Director of Intelligence), Brigadier General 
^^^|coming away with a better understanding of their perspectives. We used the 
opportunity to explain to them how NSA's distributed analytic enterprise can be 
engaged in efforts to meet their information needs. 



(U//FOUO) Our session w ith the J3 w as very positive and he appreciated the value 
of analysis. Rear Admiral feels strongly that intelligence sharing needs a 

systematic approach to enable transparency. Me recognizes that we are integrated 
and connected and therefore can't afford to operate independently, 

(U//FOUO) We next met with the J2, BG ^^^|'The JAC (EUCOM ‘s Joint Analysis 
Center in Molesworth, England) joined us virtually, giving us the chance to hear 
their concerns. We discussed the Mission Build-out, governance, resource 
challenges and mission management of a distributed enterprise, A key area of 
concern is "less commonly taught languages" and what we're doing to meet that 
challenge. We made sure they knew that A&P is at the forefront by leveraging 
language resources in Utah (see a related message ), the National Virtual 
Translation Center (NVTC), and our 2nd party partners. We intend to leverage 
those opportunities enterprise-wid e. We a lso discussed the new "lane structure" 
and the Strategic Mission List , BG interested in results from an all-source 

perspective and asked that we keep our capabilities relevant to EUCOM, Me was 
glad we were there and hoped we would gain an appreciation of their ops during 
the rest of our visit. 



(U//FOUO) We also held a town meeting with NCEUR personnel to cover current 
events relating to resources and the structure of the Agency, as well as strategic 
planning initiatives. Major points included: 

* Future trends and challenges in A & P 

* Future roles for the extended enterprise in A & P 
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* Changes in IT infrastructure due to new tools and techniques 

* S2 Assessment Cell 

* Senior Intelligence Authority issues 

(U//FOUO) We need to ensure we take advantage of their forward presence. As a 
forward -deployed function they are empowered leaders and strategists. We need to 
keep doing forward what's best done forward! Following a busy and productive day 
we went to a great little restaurant 11 Waldheim" - or "home in the woods," 



(U//FOUO) Patch Barracks, near Stuttgart: home to EUCOM HQ and NCEUR. 

Darmstadt: The European Security Center (U//FOUO) 

(U//FOUO) On the morning of Wednesday 1 1 January, we traveled to Darmstadt 

visit with the 66th MI Group Center, CO^^^^ 

J^J^^m^66th MI GF Commander; LTC Dire ctor^^^| 

Deputy Director; and their energetic team provided an outstanding 
overview of their organizational structure, operations, successes and challenges, 

(U//FOUO) The ESC^ is a functioning part of the enterprise. They've made great 
strides in their analytic expertise, The analytic support received from SID/S2/SSG 
is great and continues to expand, S2 elements, in particular GEO, CT , RT , and CP, 
were lauded for their outstanding support. The ESC, as an A&P- forward function 
gives them many advantages, Their state-of-the-art operations area allows them 
quick, deployable, and operational partnerships. Weekly VTCs with virtual teams 
for targets relevant to the EUCOM theater help them maintain perspective, 

Wiesbaden: The European Technical Center (U//FOUO) 

(U//FOUO) We drove on to Wiesbaden that evening. We met up with folks from the 
ETC for dinner (at a great restaurant - The Winkger (yes, the Vikinger)) to get to 
know a bit about each other and to help set the stage for Thursday's visit. Through 
a series of briefings we gained a good perspective on the critical role ETC plays in 
the enterprise and gained an appreciation of how we can work together to benefit 
the enterprise. We also held a town meeting with the ETC team where I reiterated 
what a great job they are doing with customers, partners, and Third Party 
relationships. 

Impressions (U) 

(U//FOUO) Throughout the visit, the knowledge and insights our personnel gain by 
being "forward" in the customer's domain was evident. Even more impressive was 
how their knowledge of other operations centers, such as NSA I IQ, the Cryptologic 
Centers, SCS . mission ground stations - just to name a few - was being leveraged to 
respond to the needs of the EUCOM customer. By knowing how the cryptologic 
system operates, and knowing howto insert requirements, our personnel are able 
to make significant contributions to the cryptologic enterprise. In addition, they 
grow professionally and personally - by seeing our Agency from a different 
perspective, gaining a broader understanding of how we're viewed, and by 
experiencing life in a different culture,. 

(U//FOUO) For more details about NCEUR type "go nceur" on your web browser! 
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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 



(U) CLASSIFICATION GUIDE FOR 
SIGINT Material Dating from 16 August 1945 *31 December 1967 



Effective Date: 21 December 2*1 1 



Revised Date's): 24 February 2*12, 12 April 2*12 
25 April 24)12 



CLASSIFIED HV 




I nlelligence Director 



K EASO N FO K C LASS I FI C A'l’IO N : 

1.4(c), 1.4 (d) 

DECLASSIFY ON: *75 years from dale of 
material or event, as indicated 



ENDORSED HY: 




Deputy Associate Director for Policy and 
Records 
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(U) Change Register 



Change No. 


Change 


Date Made 

mm/dd/yy 


By 

(initials) 


1 


Numerous administrative changes were made to clarify 
certain guidance, correct some errors in dates, revise the 
proposed exemption categories, and correct typos. 


02/24/12 


SLS 


2 


Entry 24 was amended to account for two specific exceptions. 


4/13/12 


SLS 


3 


Entry 3 was amended to bring it in line with previous 
guidance regarding intercept or reference to specific intercept 
of belligerent or non-belligerent communications through 31 
December 1946 


4/25/12 


SLS 
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(U) Classification Guide for SJGJNT Material Dating Prior to l January 1968 



(U) PUBLICATION DATE; 

(U) OFFICE OF ORIGIN: SJD 
(U//FOUO) S02 

(U) PHONE: 



(U) ORIGINAL CLASSIFICATION AUTHORITY: 
SJGJNT Director, 



(U) This classification guide describes the SJGJNT material that is dated from 16 August 
1945 - 3 1 December 1 967 and warrants protection for more than 50 years. It supersedes 
all prior guidance relating to material originating during this timeframe. This guidance 
pertains to NSA'CSS as u r cll as to its predecessor organizations. 



Description of Information 


i ’ lassi flea tkm/Mii rk i ngs 


Reason 


Declass 


Remarks 












1 . (U) All sources- a nd methods - 
related metadata added to 
SIGfNT product reports by 
NSACSS or included id 
NSACSS metrics reports 


CON FJDti NTl A D/RC L 1 0 
USA, FVEY ai a minimum 


50X1 

50X3 

50X6 


*75 years 
from date 
of 

material 


(U//FQUQ) This includes 
information such as SlGLNT 
addresses (SlGADs), 
Producer Designator 
Digraphs (PDDGs), Case 
Notations (CASNs), RASIN 
Manual designators, intercept 
designators, SRls, Crypt 
System Titles, Intelligence 
Source Indicators (IS Is), 

Time of Intercept (TOf), 
Communications Lanes 
(foreign F RGM/TG entities), 
Message Telex numbers 
assigned by foreign target, 
number of messages collected 
for a specific target, number 
of messages decrypted for a 
specific target, etc. 

(U) Exceptions: For the 
period of the Vietnam 
conflict (through 3-1 
December 1967) - all 
metadata for otherwise 
releasable reports in which 
the targeted entity was a 
participant in the Vietnam 
conflict Ls UNCLASSIFIED. 

(U//FOUG) The 
methodologies used by 
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NSA/CSS to log, track, 
account for, and analyze 
collection prior to 1968 are 
still used today. Revealing 
this “who,” “when,” “where,” 
and “how” could provide an 
adversary with a great deal of 
insight into NSA’s targets, 
collection sites, and other 
collection- and analysis- 
related information that is 
still being used today. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


2. (S//NF) Information revealing 


SECRET//REL TO USA, 


75X1 


*75 years 


(U) The fact of NSA/CSS 


the fact of NSA/CSS targeting, 


FVEY at a minimum 


75X3 


from either 


targeting, collecting, or 


collecting, or processing the 




75X6 


the date of 


processing against any nation 


communications of these 






material or 


not listed as classified 


specific foreign 






the end of 


through 1967 is 


countries/international 






the 


UNCLASSIFIED. 


organizations: 






particular 










partnership, 


(U) Revealing these specific 


- Algeria after 31 Dec 1946 






whichever 


targets will enable 


- Belgium after 31 Dec 1946 






is longer 


adversaries to deduce the 


- France after 31 Dec 1946 








strength and range of 


- Germany (i.e., West Germany) 








NSA/CSS’s capabilities at 


after 31 Dec 1946 








that time. When there is 


- Netherlands after 31 Dec 1946 








direct link between the 


- Norway after 31 Dec 1946 








communications systems used 


- Saudi Arabia after 3 1 Dec 








then and those used today, 


1946 








the targets can adopt blanket 


- Sweden after 31 Dec 1946 








denial practices not currently 


- Tunisia after 31 Dec 1946 








used because they simply do 


- Turkey after 3 1 Dec 1946 








not appreciate how well their 










signals are currently being 


- Taiwan (Formosa) after 








exploited by NSA/CSS. In 


31 Dec 1949 








addition, certain historical 










targets are also (and were in 


- Italy after 3 1 Dec 1947 








the timeframe covered by this 


- Jordan after 31 Dec 1947 








guide) SIGINT partners, and 










revealing that NSA/CSS 


- Denmark after 3 1 Dec 1953 








targeted nations that are 


- South Korea after 3 1 Dec 








current partners could have 


1953 








an immediate negative effect 










on those relationships. 


- Japan after 31 Dec 1954 


















(U) The fact that NSA/CSS 


- Austria after 31 Dec 1955 








processed intercepted Israeli 










communications during the 


- Israel for any timeframe (see 








USS Liberty incident (24 
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remark for specific exception) 

- Pakistan for any timeframe 

- Singapore for any timeframe 

- all international organizations 








May - 8 June 1967) is 
UNCLASSIFIED. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


3. (S//NF) Information revealing 


SECRET//NOFORN 


75X1 


*75 years 


(S//NF) Second Party 


the fact of NSA/CSS targeting, 




75X3 


from either 


partnerships are among 


collecting, or processing the 




75X6 


the date of 


NSA/CSS’s strongest, oldest, 


communications of a Second 
Party country 




75X9 


material or 
the end of 
the 

partnership, 
whichever 
is longer 


and most important. 
Revealing the fact that 
NSA/CSS targeted their 
communications at any time 
would most likely have 
serious implications for, and 
could cause irreparable 
damage to, the partnerships. 

(U) Serious damage to 
national security can be 
expected if this material were 
to be declassified. 


4. (U) The identities of specific 


SECRET//REL TO USA, 


75X1 


*75 years 


(U//FOUO) NSA/CSS’s 


NSA/CSS Third Party SIGINT 


FVEY at a minimum 


75X3 


from either 


Third Party partners provide 


partners 




75X6 


the date of 
material or 
the end of 
the 

particular 
partnership, 
whichever 
is longer 


NS A with unique and 
valuable insights on 
counterterrorism, combating 
proliferation, and regional 
stability issues. They also 
often provide NSA/CSS 
information about each other. 
Although they may suspect 
they were targets prior to 
1968, their level of 
cooperation with NS A is 
expected to diminish if it 
became a known fact. 
Conversely, if information 
that NSA/CSS has relating to 
these countries that is outside 
the scope of the partnerships 
were to be released, the 
countries could gain insight 
into NSA’s other SIGINT 
capabilities, and could also 
become aware of information 
that NSA/CSS has not been 
sharing. The future of 
NSA/CSS’s Third Party 
SIGINT foreign partnerships 
would be at stake. 



TOP SECRET//SI/TK//NOFORN 



TOP SECRET//SI/TK//NOFORN 











(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


5. (U) The fact that NSA/CSS 


CONFIDENTIAL//REL TO 


75X1 


*75 years 


(U//FOUO) NSA/CSS’s 


shared particular SIGINT 


USA, FVEY at a minimum 


75X3 


from either 


Second Party partnerships are 


material with a specific Second 




75X6 


the date of 


extraordinarily close, and in 


Party partner, when the partner 
is identifiable 




75X9 


material or 
the end of 
the 

particular 
partnership, 
whichever 
is longer 


some cases it is impossible to 
tell where one partner’s work 
ends and another’s starts. In 
many cases, for a variety of 
reasons originating within the 
respective partner’s 
government, Second Party 
partners insist that their 
involvement in specific 
projects or operations must 
not be released. The 
UKUSA agreement, signed in 
1946, mandates that the 
Second Parties respect each 
others’ preferences in these 
cases. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


6. (U) The fact that NSA/CSS 


SECRET//REL TO USA, 


75X1 


*75 years 


(U//FOUO) NSA/CSS’s 


shared particular SIGINT 


FVEY at a minimum 


75X3 


from either 


Third Party partners provide 


material with a specific Third 
Party partner, when the partner 
is identifiable 




75X6 


the date of 
material or 
the end of 
the 

particular 
partnership, 
whichever 
is longer 


NS A with unique and 
valuable insights on 
counterterrorism, combating 
proliferation, and regional 
stability issues. If it were 
revealed that NSA/CSS 
shared particular information 
with specific Third Party 
partners (essentially revealing 
the countries with which it 
had Third Party SIGINT 
partnerships prior to 1968), 
the future of its Third Party 
SIGINT foreign partnerships 
would be at stake. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
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this material were to be 
declassified, depending on 
the particular information 
being revealed. 


7. (U) Information revealing 


SECRET//REL TO USA, 


50X1 


*75 years 


(U) Exceptions: 


NSA/CSS targeting, collecting, 


FVEY at a minimum 


50X3 


from date 




or processing diplomatic or 
leadership communications of a 
specific foreign 

country/countries, international 
organization, group of 
individuals, or individual (post 
31 December 1946) 




50X7 


of material 


- (U) diplomatic/leadership 
communications collected 
during and related to the 
Cuban Missile Crisis (1 
January 1959-31 December 
1963) are UNCLASSIFIED 

- (U) North Vietnamese, 
Laotian, or Cambodian 
diplomatic/leadership 
communications related to 
the Vietnam conflict and 
collected between 1 January 
1960 and 31 December 1975 
are UNCLASSIFIED 

(U//FOUO) Indicating whose 
diplomatic/leadership 
communications NSA/CSS 
targeted, collected, and/or 
processed prior to 1968 
would cause diplomatic 
challenges for the U.S., and 
could also enable a targeted 
country that is still using 
similar communications 
systems to change their 
systems, thereby denying 
NSA/CSS valuable 
intelligence. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


8. (U//FOUO) Information 


SECRET//REL TO USA, 


50X1 


*75 years 


(U//FOUO) Indicating whose 


revealing NSA/CSS targeting, 
collecting, or processing of 
specific international 
commercial (ILC) 
communications (post 3 1 
December 1946) 


FVEY at a minimum 


50X3 


from date 
of material 


ILC communications 
NSA/CSS targeted, collected, 
and/or processed prior to 
1968 could also enable a 
target that is still using 
similar communications 
systems to change its 
systems, thereby denying 
NSA/CSS valuable 
intelligence. 
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(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


9. (U) Information that contains or 


CONFIDENTIAL//REL TO 


75X1 


*75 years 


(U//FOUO) This includes the 


reveals foreign SIGINT partner 


USA, FVEY at a minimum 


75X3 


from either 


basic “fact of’ specific Third 


equities 




75X6 


the date of 


Party partnerships, names of 






75X9 


material or 


personnel associated with 








the end of 


partner organizations (Second 








the 


or Third Party), indications of 








particular 


projects that were worked 








partnership, 


with specific foreign partners 








whichever 


(Second or Third Party), 








is longer 


collection locations in partner 
nations (Second or Third 
Party), etc. 










(U//FOUO) NSA/CSS’s 
foreign partners provide NS A 
with unique and valuable 
insights on a wide variety of 
issues that are critical to U.S. 
national security (e.g., 
counterterrorism, combating 
proliferation, and regional 
stability). It is a given that 
they need to protect their 
equities as vehemently as 
NSA/CSS protects its own. 

If NS A/CSS were to release 
information that revealed the 
equities of its foreign partners 
(Second as well as Third 
Parties), the future of its 
SIGINT foreign partnerships 
would be at stake. 










(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


10. (U//FOUO) Information 


CONFIDENTIAL//REL TO 


75X1 


*75 years 


(U//FOUO) Revealing 


revealing specific overseas 


USA, FVEY at a minimum 


75X3 


from either 


specific overseas collection 


collection and High-Frequency 




75X6 


the date of 


and HFDF locations could 


Direction Finding (HFDF) 






material or 


adversely affect Third Party 


locations that remain open 






closure of 


SIGINT partnerships and 


today 






site, 


reveal NSA/CSS’s HFDF 








whichever 


capability strengths and 








is longer 


weaknesses. Such revelations 
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would identify NSA/CSS’s 
Third Party partners and 
enable its adversaries to 
develop countermeasures 
against its strengths and 
exploit its weaknesses. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


1 1 . (S//SI//REL TO USA, FVEY) 


SECRET//SI//REL TO USA, 


75X1 


*75 years 


(S//SI//REL TO USA, 


The fact that NSA/CSS 


FVEY 


75X3 


from either 


FVEY) Revealing the fact 


conducted/conducts covert 




75X6 


the date of 


that NSA/CSS conducted 


SIGINT operations at 
unspecified officially flagged 
U.S. facilities abroad 




75X7 


material or 
end of 
overall 
activity, 
whichever 
is longer 


covert SIGINT operations 
from officially flagged U.S. 
facilities abroad would impair 
the effectiveness of 
intelligence methods 
currently in use; would reveal 
information that would cause 
serious harm to relations 
between the United States 
and a foreign government, or 
to ongoing diplomatic 
activities of the United 
States; and could impair the 
ability to provide protection 
services to those U.S. 
Government officials 
authorized protection (e.g., 
President, Vice President). 


12. (S//REL TO USA, FVEY) The 


TOP SECRET//SI//REL TO 


75X1 


*75 years 


(S//SI//REL TO USA, 


association of a specific 


USA, FVEY 


75X3 


from either 


FVEY) Revealing that 


location with an SCS site, the 




75X6 


the date of 


NSA/CSS conducted covert 


existence of which is releasable 
to Second Party partners 




75X7 


material or 
end of 
overall 
activity, 
whichever 
is longer 


SIGINT operations from 
specific officially flagged 
U.S. facilities abroad would 
impair the effectiveness of 
intelligence methods 
currently in use; would reveal 
information that would cause 
serious harm to relations 
between the U.S. and a 
foreign government, or to 
ongoing diplomatic activities 
of the U.S.; and could impair 
the ability to provide 
protection services to those 
U.S. Government officials 
authorized protection (e.g., 
President, Vice President). 
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(U) Exceptionally grave 
damage to national security 
can be expected if this 
material were to be 
declassified. 


13. (S//REL TO USA, FVEY) The 


TOP SECRET//SI//NOFORN 


75X1 


*75 years 


(S//SI//REL TO USA, 


association of a specific 




75X3 


from either 


FVEY) Revealing that 


location with an SCS site that is 




75X6 


the date of 


NSA/CSS conducted covert 


NOFORN 




75X7 


material or 
end of 
overall 
activity, 
whichever 
is longer 


SIGINT operations from 
specific officially flagged 
U.S. facilities abroad would 
immediately impair the 
effectiveness of intelligence 
methods currently in use; 
would reveal information that 
would cause serious harm to 
relations between the United 
States and a foreign 
government, or to ongoing 
diplomatic activities of the 
United States; and could 
impair the ability to provide 
protection services to those 
U.S. Government officials 
authorized protection (e.g., 
President, Vice President). 

(U) Exceptionally grave 
damage to national security 
can be expected if this 
material were to be 
declassified. 


14. (U) Information revealing 


CONFIDENTIAE//REE TO 


50X1 


*75 years 


(U//FOUO) NSA/CSS uses 


specific sources and methods 


USA, FVEY at a minimum 


50X3 


from date 


the same sources and 


used by NSA/CSS to target, 
collect, and/or process SIGINT 
and that are currently used 
today 




50X6 


of material 


methods to obtain SIGINT 
today as it did prior to 1968. 
Revealing the specific 
sources and methods used by 
NSA/CSS to target, collect, 
and/or process SIGINT 
would enable targets to adopt 
blanket denial practices not 
used today because they 
simply do not appreciate how 
well their signals are 
currently being exploited by 
NSA/CSS. 

(U) See Entry 3 1 for 
additional information. 


15. (TS//SI//REF TO USA, FVEY) 


TOP SECRET//SI//NOFORN 


50X1 


*75 years 


(TS//SI//REL TO USA, 


Information revealing the fact 




50X3 


from date 


FVEY) NSA/CSS’s covert 


of, as well as details relating to, 
NSA/CSS conducting covert 




50X6 


of material 


SIGINT activities, such as 
SIGINT enabling and the use 
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SIGINT activities, including 








of particular cover 


material dealing with SIGINT 








mechanisms, are much the 


enabling; cover plans, 








same today as they were prior 


programs, and mechanisms; 








to 1968. Revealing the 


and/or clandestine SIGINT 








specific covert activities 
would nullify the particular 
programs where they are 
successfully used today. 
Targets would adopt blanket 
denial practices not used 
today because they simply do 
not appreciate how 
NSA/CSS’s covert activities 
support SIGINT successes. 










(U) Exceptionally grave 
damage to national security 
can be expected if this 
material were to be 
declassified. 


16. (U) TICOM documents dated 


CONFIDENTIAL//REL TO 


50X1 


*75 years 


(U) TICOM documents 


prior to 31 December 1967 


USA, FVEY at a minimum 


50X3 


from date 


should only be released if 


where the acquired document 




50X6 


of material 


they would have been 


was originally created by the 




50X9 




released by the U.S. or 


U.S. or a Second Party partner 
and was in the possession of an 








Second Party directly. 


’’enemy” organization. 








(U) TICOM documents that 
may be declassified and 
released include acquired 
code books and the 
description of applications of 
techniques to cryptographic 
systems. 










(U//FOUO) TICOM was a 
joint Five Eyes effort. 
NSA/CSS’s Second Party 
partnerships are 
extraordinarily close, and in 
some cases it is impossible to 
tell where one partner’s work 
ends and another’s starts. In 
many cases, for a variety of 
reasons originating within the 
respective partner’s 
government, Second Party 
partners insist that their 
involvement in specific 
projects or operations must 
not be released. The 
UKUSA agreement mandates 
that the Second Parties 
respect each others’ 
preferences in these cases. 
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(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


17. (U) TICOM interrogation 


CONFIDENTIAL//REL TO 


50X1 


*75 years 


(U) TICOM documents 


reports 


USA, FVEY, at a minimum 


50X3 


from date 


should only be released if 






50X6 


of material 


they would have been 






50X9 




released by the U.S. or 
Second Party directly. 










(U) In some cases, TICOM 
interrogation reports remain 
not releasable due to BRUSA 










agreements to protect 
personal information whose 
release could reasonably be 
expected to constitute an 
unwarranted invasion of 
personal privacy of a living 
person. 










(U//FOUO) TICOM was a 
joint Five Eyes effort. 
NSA/CSS’s Second Party 
partnerships are 
extraordinarily close, and in 
some cases it is impossible to 
tell where one partner’s work 
ends and another’s starts. In 










many cases, for a variety of 
reasons originating within the 
respective partner’s 
government, Second Party 
partners insist that their 
involvement in specific 
projects or operations must 
not be released. The 
UKUSA agreement mandates 
that the Second Parties 
respect each others’ 
preferences in these cases. 










(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


18. (U) ELINT material related to 


S//REL TO USA, FVEY at a 


50X1 


*75 years 


(U//FOUO) Many of the 


radar/weapons systems that are 


minimum 


50X3 


from date 


collection and exploitation 


still used today 






of material 


methods used prior to 1968 
continue to be employed in 
the Intelligence Community. 
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Declassifying ELINT 
material that is 50 years old 
(and older) would enable 
adversaries, who do not 
appreciate how well their 
signals are currently being 
exploited by NS A, to 
ascertain those collection and 
analysis techniques and 
subsequently adopt denial 
practices that could preclude 
further intelligence 
exploitation. Such denial 
would hamper intelligence of 
the modification of old 
systems as well as the newest 
ones. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


19. (U//FOUO) A single ELNOT or 
list of ELNOTs or designators 
that equate to specific radars, 
including those from weapons 
systems, or similar non- 
communications signal devices 
weapons system when 
associated with amplifying data 
that identifies the emitter radar, 
weapon system, country of 
origin, or ELINT signal 
acquisition method. 


CONFIDENTIAL//REL TO 
USA, FVEY at a minimum 


50X1 

50X3 


*75 years 
from date 
of material 


(U//FOUO) This category 
includes information equating 
a specific ELNOT with a 
specific radar nickname, such 
as a NATO nickname, or a 
radar model number. 

(U//FOUO) A single ELNOT 
or list of ELNOTs or 
designators, e.g., B329A, 
1222Z, T6090, 123MZ, when 
used without amplifying data 
that identifies the emitter 
radar, weapon system, or 
country of origin, or ELINT 
signal acquisition method is 
UNCLASSIFIED 

(C//REL TO USA, FVEY) 
Examples: 

- the fact that P307Z and 
P334A emanate from the 
Crotale surface-to-air missile 
is classified 

CONFIDENTIAL//REL TO 
USA, AUS, CAN, GBR, 

NZL 

- the fact that A427B 
emanates from SLOT BACK 
radar is 
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CON F IDE NTIAL7RE L TO 
USA, AUS, CAN, CiBR, 

NZL 

(U//FOUO) Many of the 
eol lection and exploitation 
methods used prior to 1968 
continue to be employed 
today. Declassifying LL1NT 
material that Is 50 years old 
(and older) would enable 
adversaries, who do not 
appreciate how well their 
signals are currently being 
exploited by NS A, to 
ascertain those collection and 
analysis techniques and 
subsequently adopt denial 
practices that could preclude 
further intelligence 
exploitation. Sueh denial 
would hamper intelligence of 
the modification of old 
systems as well as the newest 
ones. 

(U) Various levels of harm to 
national security can be 
expected, if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


20. (U//FOUO) US 1 NT-related 
material (i.e., information 
related to collection, 
processing, and analysis of 
telemetry and beacons, 
command uplinks, video data 
links, tracking, and 
arming/fits ing/command signal s 
as well as reporting based on 
said data types) 


SECRET//REL TO USA, 
h'VEY at a minimum 


50X1 

50X3 


*75 years 
from date 
of material 


(U) Exceptions: 

- Refer to the following 
Information Management 
Ins tructions { 1 M 1 s) for 
guidance on specific 
UNCLASSIFIED FI Si NT- 
rclared information: 

- DEFSMAC 1M1 

- Soviet Deep Space 
Telemetry Collection 1M1 

(U//FOUO) FIS INT activity 
began in 1956, and amounts 
to information that weapons 
designers use to verify 
weapon system performance 
capabilities. The exact 
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collection and exploitation 
methods used from that time 
are still being used 
successfully today. 

(U//FOUO) Declassification 
of FISINT-related material 
that is 50 years old and older 
would show NSA/CSS’s 
ability to fully exploit the 
data, even with the lack of an 
identification key and poor 
signal quality, and likely lead 
to widespread data denial 
practices among target 
countries who do not 
currently appreciate how well 
their signals are currently 
being exploited by NS A. 

This would deprive the U. S. 
of vital knowledge of foreign 
weapons and space systems, 
which in turn would 
ultimately lead to policy 
decisions being made on 
faulty/incomplete data and to 
increased loss of life and 
mission failure during future 
military operation. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


21. (U//FOUO) SIGINT material 


TOP SECRET //SI//N OF ORN 


50X1 


*75 years 


(C//REL TO USA, FVEY) 


pertaining to counterespionage 




50X3 


from date 


Foreign intelligence services’ 


efforts that reveal NSA/CSS 
knowledge, exploitation, and 
analysis of adversaries’ 
tradecraft that is still being used 
today 




50X6 


of material 


tradecraft is unique to the 
individual service. 
Declassifying information 
indicating that NSA/CSS has 
successfully exploited their 
activities, or that it 
understands their 
methodologies, would enable 
the adversaries to refine or 
alter their practices to the 
point where it might be 
denied the information/access 
entirely (an example would 
be cover names of agents of 
an adversary’s intelligence 
service). Adversaries’ 
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imderiy ing [ radeera ft 
( in cl tiding oomimm ications 
methods and patterns, and all 
aspects of recruitment and 
handling of age tils) generally 
remains the same over t i me, 
and must he protected in 
order to maintain NSA/CSS + s 
ability to exploit iL In 
addition, such material may 
reveal the identities of a 
person, or the cooperation of 
a still -I i v ing person, who was 
the source of information for 
evidence that was compiled 
against spies who were Later 
arrested, causing that 
per son ^s life to he in 
jeopardy. 

(U) Exceptionally grave 
damage to national security 
can he expected, if this 
material were to he 
declassified. 
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(C//TRHL TO USA, ]-VLY) 
Releasing decrypts allows the 
target to deduce the strength 
and range of NSA/CSS's 
capabilities at that time. 

When there is direct link 
between the cryptologies 
used then and those used 
today, a straightforward 
interpolation would allow the 
target who builds and uses 
indigenous logics to 
determine the minimum 
strength required to defeat 
NSA/C£S + s diagnosis and 
exploitation today . They can 
then build and deploy 
stronger logics or design and 
deploy logics using different 
crypto-principles than those 
used previously. When 
commercially available logics 
were used* the target can buy 
stronger logics or purchase 
from a different supplier, 
again with strength and 
crypto design principles to 
defeat NS A/CSS *s 
exploitation. When 
NS A/CSS releases a selected 
target's decrypts, it has 
already seen substantive 
changes in that target's use of 
cryptography. 


25. (U) SlGiNT serialized Product 
Reports that contain cryptologic 
information 


tt )N ] ■' ] L>L N'l 1 A L'/S] // RLL T ( > 
USsA, FVEY ai a minimum 


50X1 

50X3 

50X6 


*75 years 
from date 
of material 
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(Uj Various levels of harm to 
national security can he 
expected if this material were 
to he declassified, depending 
on the particular information 
being revealed. 


26. (U) SlGlNT serial ized Product 


CON F IDENTI AL7/S [//REL TO 


50X1 


*75 years 


(S//S1//REL TO USA, 


Reports consisting of or 


USA, FVEY at a minimum 


50X3 


from date 


FVEY) SlGlNT serialized 


containing decrypts for the 
Soviet Bloc or People' s 
Republic of China for the 
period 1 January 195 1 through 
31 December 1967 




50X6 


of material 


product reports for the Soviet 
Bloc or Peopled Republic of 
Ch i na eons Is ting of or 
containing decrypts for the 
period 16 August 1945 
through 31 December 1950 
are UNCLASSIFIED, as long 
as all relevant sources - and 
methods -related metadata has 
been redacted. 

(U//FOUO) Relevant 
sources- and me thods -related 
metadata includes post- 
BR USA system titles, which 
did not exist until 1946 and 
cornpri sed a com hi na cion of 
four or more letters and/or 
numbers. In addition, it 
includes ease notations, 
RASIN Manual designators, 
and intercept designators, 
which are not strictly 
eryptanalytie, but have 
relevance to eryptanalytie 
equities. 

( U ) Information reveal i ng 
NS A/CSS targeting, 
collecting, or processing of 
diplomatic or leadership 
communications of a specific 
foreign country /countries, 
international organ ization, 
group of individuals, or 
individual - Ibr any 
limeira me - remain 
classified, except for those 
decrypted using techniques 
declassified in the versions of 
Military Crvptanalvties 1 and 
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released by NS A, that were 
collected during and related 
to the Cuban Missile Crisis (1 
January 1959-31 December 
1963), and North 
Vietnamese, Laotian, or 
Cambodian 
diplomatic/leadership 
communications collected 
prior to 31 December 1975, 
which are UNCLASSIFIED. 

(C//REL TO USA, FVEY) 
Releasing decrypts allows the 
target to deduce the strength 
and range of NS A/CSS’s 
capabilities at that time. 

When there is direct link 
between the cryptologies 
used then and those used 
today, a straightforward 
interpolation would allow the 
target who builds and uses 
indigenous logics to 
determine the minimum 
strength required to defeat 
NSA/CSS’s diagnosis and 
exploitation today. They can 
then build and deploy 
stronger logics or design and 
deploy logics using different 
crypto-principles than those 
used previously. When 
commercially available logics 
were used, the target can buy 
stronger logics or purchase 
from a different supplier, 
again with strength and 
crypto design principles to 
defeat NSA/CSS’s 
exploitation. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


27. (U) SIGINT serialized Product 


CONFIDENTIAL//SI//REL TO 


50X1 


*75 years 


(S//SI//REL TO USA, 


Reports consisting of or 
containing decrypts for North 
Korea for the period 1 July 
1951 through 31 December 
1967 


USA, FVEY at a minimum 


50X3 

50X6 


from date 
of material 


FVEY) SIGINT serialized 
product reports for North 
Korea consisting of or 
containing decrypts for the 
period 16 August 1945 
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through 30 June 1951 are 
UNCLASSIFIED, as long as 
all relevant metadata, 
including sources - and 
me thixls -related information, 
has been redacted. 

(U//FGUO) Relevant 
sources- and me thirds -related 
metadata ineludes post- 
BR USA system titles, which 
did not exist until 1946 and 
comprise a combination of 
four or more letters and/or 
numbers. In addition, it 
includes case notations, 
RASfN Manual designators, 
and intercept designators, 
which are not strictly 
cryptanalytic, but have 
relevance to cryptanalytic 
equities. 

(U) All reports by Korea- 
based field units based on the 
exploitation of manual codes 
and ciphers, provided they 
make no connection to 
encrypted comm unications , 
during and related to the 
Korean War, 25 June 1950 - 
31 December 1953 are 
UNCLASSIFIED. 



(U) Information revealing 
NS A/CSS targeting, 
collecting, or processing of 
diplomatic or leadership 
communications of a specific 
foreign country /countries , 
i me mat ional organ izat ion, 
group of individuals, or 
individual - for any 
Liiiiefrtmic - remain 
classified, except for those 
decrypted using techniques 
declassified in the versions of 
Military Cry ptanaly tics 1 a nd 
J L written by 




|and officially 
released by NS A that were 
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collected during and related 
to the Cuban Missile Crisis (1 
January 1959-31 December 
1963), and North 
Vietnamese, Laotian, or 
Cambodian 
diplomatic/leadership 
communications collected 
prior to 31 December 1975, 
which are UNCLASSIFIED. 



(C//REL TO USA, FVEY) 
Releasing decrypts allows the 
target to deduce the strength 
and range of NSA/CSS’s 
capabilities at that time. 

When there is direct link 
between the cryptologies 
used then and those used 
today, a straightforward 
interpolation would allow the 
target who builds and uses 
indigenous logics to 
determine the minimum 
strength required to defeat 
NSA/CSS’s diagnosis and 
exploitation today. They can 
then build and deploy 
stronger logics or design and 
deploy logics using different 
crypto-principles than those 
used previously. When 
commercially available logics 
were used, the target can buy 
stronger logics or purchase 
from a different supplier, 
again with strength and 
crypto design principles to 
defeat NSA/CSS’s 
exploitation. 



28. (U) SIGINT serialized Product CONFIDENTIAL//SI//REL TO 
Reports consisting of or USA, FVEY at a minimum 

containing decrypts for any 
other target (i.e., not Soviet 
Bloc or People’s Republic of 
China from 1 Jan 1951-31 Dec 
1967, not North Korea from 1 
July 1951-31 Dec 1967) for the 



50X1 

50X3 

50X6 



*75 years 
from date 
of material 



(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 

being revealed. 

(U) Information revealing 
NSA/CSS targeting, 
collecting, or processing of 
diplomatic or leadership 
communications of a specific 
foreign country/countries, 
international organization, 
group of individuals, or 
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target’s decrypts, it has 
already seen substantive 
changes in that target’s use of 
cryptography. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


29. (U) Alphabet Generators: 


CONFIDENTIAL//SI//REL TO 


50X1 


*75 years 


(U) A document that 


Documents that demonstrate or 


USA, FVEY at a minimum 


50X3 


from date 


demonstrates or includes the 


include the application of any 
cryptanalytic technique relating 
to Alphabet Generator systems 
that became operational after 
15 August 1945 




50X6 


of material 


application of any 
cryptanalytic technique to an 
electromechanical cipher 
system that is an alphabet 
generator is 

UNCLASSIFIED only if the 
system is UNCLASSIFIED in 
accordance with the WWII 
Guidance. 

(U) This guidance pertains to 
documents relating to: 

• Wired wheels (such as 
ENIGMA), 

• Telephone selectors 
(such as PURPLE, RED, 
JADE, and CORAL), 
and 

Hagelin alphabet generators. 

(C//REL TO USA, FVEY) In 
this time frame, commercial 
companies and nation states 
developed and deployed 
cryptographies which have 
many features still in use in 
cryptosystems NSA/CSS 
exploits today. Documents 
that detail the application of 
cryptanalytic techniques to 
these earlier systems will 
reveal capabilities still in use 
today against operational 
target cipher systems. 

(U) Various levels of harm to 
national security can be 
expected if this material were 



TOP SECRET//SI/TK//NOFORN 



TOP SECRET//S1/TK//N OFORN 











to he declassified, depending 
on the particular information 
being revealed. 


30. (U) Cryplosy stem s Or her Than 
Alphabet Generators: 
Documents lhal demonstrate or 
include the application of a 
cryplanalylic technique to any 
cipher system other than an 
alphabet generator 


CONF [DENTIAL7/SI//REL TO 
USA, FVEY ai a minimum 


50X1 

50X3 

50X6 


*75 years 
from date 
of material 


(U) This guidance includes 
documents relating to any 
electromechanical system s 
that are key generators , to 
include HagelinJfcey 
generators and TUNNY. 

(U) K\cc|jLion: When a 
document only contains 
specific previously 
declassified techniques 
applied to a low-grade or 
medi um -grade cryptograph ie 
system, the document will be 
UNCLASSIFIED unless it 
deals with the application of 
depth reading Or depth - 
reading techniques. 
Previously declassified 
techniques are those 
declassified in the versions of 
Military Crvplanalvtics 1 and 
1 1. v. I ll- l 1 It - 

released by NS A. 

(U) Cryptanalytic worksheets 
remain classified if they: 

- are for key generators, 
and/or 

- i ndieatc depth or depth - 
reading techniques (e.g., 
have different cipher 
texts associated with the 
same key) 

- are a ssoeiated wi th a 
spec ific operational 
targe t 

(G7REL TO USA PVEY) 

In this time frame, 
commercial companies and 
nation states developed and 
deployed cryptographies 
which have many features 
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still in use in cryptosystems 
NSA/CSS exploits today. 
Documents that detail the 
application of cryptanalytic 
techniques to these earlier 
systems will reveal 
capabilities still in use today 
against operational target 
cipher systems. 



3 1 . (TS//SI//REL TO USA, FVEY) 
Commercial Cryptanalytic 
Relationships: Documents that 
contain information that implies 
that commercial companies 
cooperate with NSA/CSS or 
Second Party partners to render 
their products exploitable from 
a cryptanalytic standpoint 



TOP SECRET//SI//REL TO 
USA, FVEY 



75X1 

75X3 

75X6 

75X9 



*75 years 
from either 
the date of 
material or 
end of the 
relation- 
ship, 

whichever 
is longer 



(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 

being revealed. 

(U) Such documents may also 
be compartmented. 

(TS//SI//REL TO USA, 
FVEY) Exposure of any 
company’s commercial 
cryptanalytic relationship 
with NSA/CSS, even for a 
company no longer in 
existence, will damage 
NSA/CSS’s credibility with 
current companies who are 
approached for assistance. 
Exposure of even decades- 
old commercial cryptanalytic 
relationships may cause 
significant harm to the 
company’s reputation and 
financial status. 



32. (C//REL TO USA, FVEY) 
Commercial Information 
Security Devices: Documents 
containing details of 
commercially available 
cryptographic algorithms, 
information security devices, or 
systems that identify an actual 
vulnerability not currently 
publicly known, or details 
relating to NSA/CSS 
exploitation of a publicly 
known vulnerability 



CONFIDENTIAL//SI//REL TO 50X1 
USA, FVEY at a minimum 50X3 

50X6 



*75 years 
from date 
of material 



(U) Exceptionally grave 
damage to national security 
can be expected if this 
material were to be 
declassified. 

(C//REL TO USA, FVEY) 
Disclosing details of 
vulnerabilities or NSA/CSS’s 
methods of choice for 
exploitation will allow 
commercial companies to fix 
those weaknesses in existing 
systems and avoid 
implementing them in future 
systems. Frequently, 
commercial companies make 
the same or similar mistakes 
through several generations 
of their products. 
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(U) Information Security 
Devices provided to other 
countries by the U.S. 
Government are considered 
Commercial Information 
Security Devices. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


33. (U) Indigenous Information 


CONFIDENTIAL//SI//REL TO 


50X1 


*75 years 


(C//REL TO USA, FVEY) 


Security Devices: Documents 
containing details of indigenous 
cryptographic algorithms, 
information security devices or 
systems 


USA, FVEY at a minimum 


50X3 

50X6 


from date 
of material 


For indigenous security 
devices or systems, any 
documents revealing 
NSA/CSS’s knowledge of the 
cryptography of those devices 
will risk its ability to 
diagnose and exploit these 
devices, and in some cases, 
knowledge it received from 
sensitive HUMINT sources. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
on the particular information 
being revealed. 


34. (U//FOUO) Signal designators 


CONFIDENTIAL//SI//REL TO 


50X1 


*75 years 


(U//FOUO) Examples of 


when combined with any details 
that would reveal a target 
user/country or when associated 
with cryptanalytically relevant 
information, such as UKUSA 
nicknames, coverterms, or any 
targeting, collection, or 
exploitation details 


USA, FVEY at a minimum 


50X3 

50X6 


from date 
of material 


signal designators include 
RASIN Manual designators 
and TEXSIGs. 

(U//FOUO) Signal 
designators with no 
indication of target user or 
country are 
UNCLASSIFIED. 

(U) This information is 
directly linked to NS A/CSS 
sources and methods for 
collection and processing. 

The Second Party standards 
and notation developed under 
UKUSA are still in use today. 

(U) Various levels of harm to 
national security can be 
expected if this material were 
to be declassified, depending 
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35. (U//FOUO) Documents dated 
after December 3 1 , 1956 that 
demons bale or include the 
application of a signals analytic, 
technique to any digital or 
digitized system 



36. (S//RELTOUSA* FVEY) 
Information identifying specific 
organizations or government 
agencies that facilitated 
NS A/CSS close access 
operations 



CON F IDE NT1 A L7S1//REL TO 
US A, FVEY at a minimum 



SECRET// REL TO USA, 
FVEY 



50X1 

50X3 

50X6 



50X1 

50X3 



*75 years 
from date 
of material 



*75 years 
from date 
of material 



on the panieular information 
being revealed. 




(U) These organizations may 
he U.S. companies, speeifie 
units within a U.S. 
government ageney, U.S. 
national laboratories* or U.S. 
academic: institutions. 

(S//REL TO USA, FVEY) 
Revealing the organizations 
that facilitated close access 
operations would have a high 
probability of causing harm 
to current operations in which 
those organizations continue 
to have a role or had a role in 
the past (even if the 
organization is now defunct), 

(U) Serious damage to 
national security can be 
expected if this material were 
to he declassified. 



3 7 . ( S//RE L l O U S A, F V EY ) T he 
faet that NS A/CSS has 
successfully conducted and has 
an organization devoted to 
close access operations 



SECRET// REL TO USA, 
FVEY 



50X3 



*75 years 
from date 
of material 



(S//REL TO USA, FVEY) 
The exact collection and 
exploitation methods used 
prior to 196S are still being 
used successfully today. 
Declassifying close access 
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material that ls 50 years old 
(and older) will enable targets 
to adopt blanket denial 
practices not used today 
because they simply do not 
appreciate how well their 
signals are currently being 
exploited by NSA.C’SS. 

(U) Serious damage to 
national security can he 
expected if this material were 
to be declassified. 
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magnetometers, 
accelerometers, and 
commercial microphones. 
This includes information 
dealing with receivers and the 
use of radar systems against 
mechanical or 
electromechanical office 
equipment, as well as 
tools/techniques no longer 
being used (such as 
magnetometers, 
accelerometers, audio signals, 
power and/or signal line 
clamps) and that have little 
chance of future use. 

(S//REL TO USA, FVEY) 
Indications that NS A has 
knowledge of specific and/or 
unusual parameters, or of 
NSA’s capabilities, could 
provide information that 
could be used to understand 
and counter the collection 
capability. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


39. (S//REL TO USA, FVEY) 
Information describing 
concealment /camouflage 
techniques for sensors/systems 
used in NS A/CSS close access 
operations 


SECRET//SI// REE TO USA, 
FVEY at a minimum 


50X3 

50X6 


*75 years 
from date 
of material 


(U) While removal of such 
sensors/systems is desired 
once a facility is no longer of 
interest, is not always 
feasible. Inadvertent 
discovery of such 
systems/sensors could 
jeopardize future operations 
and/or raise questions about 
or point to NSA’s 
involvement. 

(U) Serious or exceptionally 
grave damage to national 
security can be expected if 
this material were to be 
declassified, depending on 
the particular information 
being revealed. 


40. (S//REL TO USA, FVEY) 
Information that identifies a 


TOP SECRET//SI// REL TO 
USA, FVEY at a minimum 


50X3 

50X6 


*75 years 
from date 


(S//REL TO USA, FVEY) 
Covert or clandestine 
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specific target, contains details 
or parameters relating to 
specific targets, and/or contains 
details that could possibly 
identify a covert or clandestine 
listening post used by 
NSA/CSS 






of material 


Eistening Posts (LPs) are 
physical locations that are 
close to the target facility and 
serve as a collection point for 
the signals of interest. 
Identification of a LP could 
result in the identification of 
information such as the 
identities of cooperating 
parties/people. Exposure of 
such information could 
adversely impact current and 
future operations by revealing 
information about partner 
relationships. 

(U) Exceptionally grave 
damage to national security 
can be expected if this 
material were to be 
declassified. 


41. (S//SI//REL TO USA, FVEY) 
Details, including the “fact of,” 
regarding NSA/CSS collection 
capability against Short 
Duration Signals (SDS) 


SECRET//SI//REL TO USA, 
FVEY 


50X3 

50X6 


*75 years 
from date 
of material 


(S//SI//REL TO USA, 

FVEY) The methods used to 
exploit SDS signals and radio 
fingerprinting are basically 
the same today as they have 
been during the period of 
interest. Specific details 
regarding how NSA/CSS 
exploits such signals, as well 
as the physical locations 
where it may access them, 
would provide adversaries 
information they need to deny 
them to NSA/CSS. Targets of 
interest could develop 
countermeasures that would 
render NSA/CSS’s current 
capability to collect SDS 
ineffective. 

(U) Serious damage to 
national security can be 
expected if this material were 
to be declassified. 


42. (U//FOUO) Details regarding 
NSA/CSS ability to perform 
radio fingerprinting 


SECRET//SI//REE TO USA, 
FVEY 


50X3 

50X6 


*75 years 
from date 
of material 


(S//REL TO USA, FVEY) 
The methods used to perform 
radio fingerprinting are 
basically the same today as 
they have been during the 
period of interest. Specific 
details regarding how 
NSA/CSS exploits such 
signals, as well as the 
physical locations where it 



TOP SECRET//SI/TK//NOFORN 



TOP SE C RE "17/SI / TKJf N OFORN 



may access them s would 
provide adversaries 
information they need to deny 
them to NSACSS, 

Exception: 

The fact of, and derails 
regarding^, U.S. and South 
Vietnamese use of radio 
fingerprinting during the 
Vietnam Conflict (1 January 
1960-31 December 1975) , as 
outlined in the Vietnam is 
UNCLASSIFIED. 

(U) Serious damage to 
national security can be 
expected if this material were 
to be declassified. 
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45. (S//SI//RELTOUSA, FVEY) 
Information regarding 
NS A/CSS ability to collect and 
process International 
Commercial ( 1 LC) , non- Second 
Party government agencies, 
non-government organizations, 
and proprietary 
communications in the radio 
frequency spectrum via 
PORN SAT or Terrestrial means 


SECRET//SI//REL 


50X3 

50X6 


*75 years 
from date 
of material 


(S//SI//REL TO USA, 

FVEY) Fundamental targets 
have not changed over time 
and they continue to use the 
same basic method of 
communication. If the fact 
that NS A targeted these 
entities is released, the 
commercial providers, 
government, non- 
government, and proprietary 
entities can implement 
countermeasures that would 
degrade NSA/CSSfs ability to 
collect and process these 
communications . 

(U) Serious damage to 
national security can he 
expected if this material were 
to he declassified. 



*75 years from dale of material or event , as indicated: (U) This indicates that the information is 
classified lor *75 years from dale a document is created or until the end of the specified event. 

ACRON VMS/DEI INITIONS: 



Acoustic - (U) Signals related to the production and transmission of sound. Sound is not restricted to audio range 
signals 

Alphabet Generator - (U) A cipher machine that generates a multiplicity of cipher alphabets from the interaction of 
two or more components. Compare to jtey generator, below. 

It KGS A - (U) The 1946 agreement, now known as UKUSA. In Appendix B (of the 26 February 1946 version) the 
section on standardization describes the functional system to be used for the nomenclature of foreign cryptograph ie 
systems. This common system of nomenclature is now called UKUSA system title s. 

Close Access - (S//RHL TO US A, FVEY) Refers to the targeting, collection, and/or processing of unintentional 
emanations from information processing equipment, as well as a program to develop special unique sensors and systems 
to collect unintentional (compromising) emanations and/or signals from information processing equipment to exploit 
TEMPEST vulnerabilities. Keywords that could identify dose access equities include (but are not limited to) 
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transducer, radiation, conductance, BOOKLET, magnetic probe, acoustic probe, magnetometer, accelerometer, 
microphone, transmitted over copper wire, emanations , and unintentional emanations. 

Cryptologic Information - (U) Information that describes the target’s use of cryptographic techniques and processes or 
of cryptographic systems, equipment, and software and their functions and capabilities, and all cryptographic material. 

Cryptanalytic Worksheets - (U) Any records that show methods of analysis of encrypted and/or enciphered 
information/data. This includes reports, working aids and papers, instructions, informal technical notes, manuals, 
technical exchange letters, handbooks, listings, collateral documents, procedure files, evaluation plans, specific 
documentation or records portraying steps, processes, tables, devices, and/or others means employed in cryptanalysis of 
target communications. 

Depth - (U) Texts are said to be in a depth relationship when the texts were produced by encrypting two or more 
different sequences of plain text with the same sequence of key. Related terms include depth reading/ stripping, flush 
depth, near depth , offset depth , partial depth , and slid depth. 

Depth Reading/Stripping - (U) Recovery of plain text and key from messages in depth. 

Electromagnetic - (U) Signals that are produced as a result of the use of electrical power 

Emanations - (U) Unintentional signals, that, if intercepted and analyzed could disclose the information transmitted, 
received, handled, or otherwise processed by information systems equipment. These signals may be acoustic , 
electromagnetic , or optical in nature 

Generic - (U) Describes emanations and sensors in broad general categories e.g. magnetic, acoustic , power line/signal 
line conductance, electric field emissions or other naturally occurring phenomena. Sensors are transducers which 
convert physical or electromechanical signals into an electrical signal which can be collected and analyzed. 

Indigenous Algorithm, Device, Logic, or System - (U//FOUO) Non-commercial cryptographic information security 
system, device or component developed by a SIGINT target for their use. Indigenous will include target modifications 
to commercial products and algorithms. If a target-developed version of a commercially available product is 
cryptographically indistinguishable from the commercial product, it will be considered commercial. 

Key Generator - (U) A cipher machine that generates key from the interaction of two or more components. Compare to 
alphabet generator , above. 

Listening Post - (U) Physical locations that are close to the target facility and serves as a collection point for the signals 
of interest 

Low-Grade - (U) Pertaining to a cryptosystem which offers only slight resistance to cryptanalysis; for example: 

(1) Playfair ciphers, 

(2) Single transposition, 

(3) Unenciphered one-part codes 

Medium-Grade - (U) Pertaining to a cryptosystem which offers considerable resistance to cryptanalysis; for example: 

(1) Strip ciphers, 

(2) Double transposition, 

(3) Unenciphered two-part codes 

RASIN - (U) Radio Signal Notation (RASIN) - A notation assigned permanently and jointly by DIRNSA and second 
Party headquarters to a signal after basic signal characteristics have been verified by NS A/CSS or Second Party signals 
analysts 

Soviet Bloc - (U) Cold War adversaries (Soviet Bloc) up to and including 1950: 

Albania, Bulgaria, Czechoslovakia (after February 1948), East Germany (though the German Democratic Republic was 
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only established on October 1949, any prior German activities in the Soviet Zone should be considered as East German 
and within this definition), Hungary, Poland, Romania, USSR, Yugoslavia 

System Title - (U//FOUO) Cryptographic system titles are short identification labels used to create a logical reference 
mechanism for ah cryptographic systems and which identifies the users. Cryptographic system titles are assigned on the 
basis of cryptography, target country, and entity. 

TEXSIG - (U//FOUO) Technical Extracts of SIGnals (TEXSIG) - A unique designator assigned to a new signal by 
a SIGINT field element (USSS or Second Party) or to a signal under analysis or cryptanalytic development by the 
headquarters of NSA/CSS and Second Parties (jointly assigned) 

TICOM - (U) Target Intelligence Committee (TICOM) - TICOM was formed in London in October 1944 as a joint 
U.S./UK activity to interrogate captured enemy COMINT personnel and to acquire enemy COMINT records and 
equipment. 



TOP SECRET//SI/TK//NOFORN 




0 N F 1 DE NTIAL//X 1 



GROUPS (CSGs) 



MOLESWORTH 

(EUCOM) 

/ NAVEUR 
// ^USAREUR 

V USAFE US 

UTTG ART 
(EUCOM) 



TRAN SCO M 



STRATCOM 
JSSPACECOM 
SAN 

"RANCISCO * 

FORSCOM 



STATE 
/ .NMJIC 
i-CIA 
-"ONI 



— ja ; a 

hawaN— 



JFCOM 



socom^/V 

CENTCOM " / 

KEY WEST SOUTHCOM 




CONFIDENTIAL// 





RET//COM I NT//RE L TO USA, AUS, CAN, GBR, and NZL//X1 



.flcnie 



rib cfl 



RY FORNSAT 
IN OPERATION 



GAR LICK 



LAPmQVf 

ryijisawa 



JjACKKNJFi 

Yakima 



SNICK 



Geraldto 



Brasili 



I RON SAND 
New Zealand 





AJ 


T X h J] ki ip] (V 


V gf? 










1*1 / a ^ - =/ “7“"— ^-r It -a*'**^ 



















K, (S//SI//REL) NSA Presence - For the following locations, the fact of NSA personnel 
assigned to these sites/activities is UNCLASSIFIED, It is therefore UNCLASSIFIED, for 
example, to display plaques from these organization/locations. How r ever, the fact that 
SIGINT may have been performed at these sites or that they may have been former A5 
sites is CLASSIFIED, 

(U) Augsbui^g, Germany (USASAFS Augsbut^g) 

(U) Bad Aibling, Germany 

(U) Baumholder, Getmany (11th U.S. ASA Field Station) 

(U) Beilin, Germany 

(U) Bremertiaven, Germany (Freedom through Vigilance USAF Security 
Service) 

(U)^ 

(u 
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(A Remote Operation s Facility) 

(U) Herzogenautach, Germany ((Strength through knowdedge) 16th USAS A Field 
Station) 

(u 

(u 

(U)^ 

(U 

(U) NSA Europe, Frankfurt, Getmany 
(U) NSAEt^opejStuttgart 

(U) Naval Security Group Activities (NSGAs) at Bremer haven, Germany; 








(S//SI//REL) Trying to Find Potential Matches for a Garbled or Misspelled 

Name? Get Help from NYMROD 

FROM: 

Project Director, Center for Content Extraction (T1221) 

Run Date: 06/11/2008 

(S//SI//REL) Have you ever had trouble finding out more about a SIGINT target 
with a garbled or misspelled name? The NYMROD system was invented to help 
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with just that problem. The NYMROD name -matching system, developed by the 
Center for Content Extraction (CCE ). can accept queries consisting of personal 
names, perform a '"fuzzy" match of the input name to one or more sets of stored 
names, and return a list of potential matches for presentation to the user, NYMROD 
finds potential name matches without wildcards and can match across scripts (for 
example, between Arabic and Roman scripts), 

(S//SI//REL) NYM ROD'S first sets of names stored for matching have all been taken 
from intelligence reports from NSA, CIA, and DoD databases, with CREST 
(transcript database) names coming on-line soon. Since its initial release in January 
2008, analysts have been using NYMROD to And information relating to targets 
that would otherwise be tough to track down. The user interface is very simple: you 
just type in the name you are looking for, set a matching threshold from 0,1 (very 
tolerant of differences) to 1,0 (exact match), select the datase(s) you want to search 
within, and submit the query. The results presentation will allow you to browse the 
snippets of text that contained the matched name. You can try out this capability 
for yourself if you " go NYMROD " in your web browser, 

(S//SI//REL) "But I don't want yet another tool!", many of you have said, and the 
CCE has taken this to heart, NYMROD also offers a web service that other systems 
can use to create their own datasets and perform matching queries. We are 
working with partners such as the Target Knowledge Base, the Unified Targeting 
Tool, and FASTS COPE to begin integrating the service into those systems so that its 
operation is available to their users without anyone having to leave their normal 
work environment. Developers can find more information about NYM ROD'S web 
service, including an Interface Control Document, on the CCE's documentation web 
page .- 

(U//FOUO) NYMROD's performance is monitored using a quality- assurance 
process. We work closely with our commercial and R6 technology suppliers to 
continuously improve the underlying matching software so that we can offer 
performance enhancements with each quarterly release of NYMROD. Our April 
2008 release made large strides in performance on Arabic names, while the 
upcoming release in July will offer greatly improved Chinese name matching. The 
CCE welcomes your feedback and inquiries. Please contact us at any time using the 
CCE HELP e-mail alias. 
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Human Language 
Technology 



Center for Content Extraction 



Chartered to distribute multi-lingual 
Content Extraction Services to NS A 
enterprise applications supporting 
and enhancing 6 analytic functions: 

Selection 
T ranslation 




Analysis 

Investigative Research 

Retrieval 

Storage 



Project Director: 




Technical Leader: 




T1221 
July 2008 
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Technology 



Nymrod Mission 



What analytic problems is Nymrod trying to 
address? 

- We need to search for the target behind what’s been 
extracted (find reported information about targeted 
persons) 

- HUMAN beings are central to most targets 

- We need to cope with linguistic variation among entity 
names (esp Person names) 

- We need to resolve Entity "coreference" problems using 
contextual information ("Evidence") 
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Human Language 
Technology 





Most Frequent Mentions in Anchory Reports for the Previous Week 
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(S//SI//REL) NSAers Make First-Ever Visit to FORNSAT Collection Site in 
^^^^^^^^^^^^^^Schoninaen, Germany 

FROM 

Joint SIGINT Activity (H52G) 

Run Date; 10/31/2006 



(U) Visitor impressed with software demos . 
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(S//SI//REL) This summer Special United States Liaison Activity Germany 
(SUSLAG) and Joint SIGI NT Activity (JSA) representatives, along with 
Counterterrorism analysts from S2I, became the first US visitors at Schoningen, a 
Bundesnachrichtendienst* (BND) FORNSAT collection site located in northern 
Germany 

(S//SI//REL) During these visits, BND senior site managers and analysts provided 
briefings on their mission, site manning, technical capabilities, as well as current 
and advanced analytic tools and technigues. These visits in June and July provided 
insights into the BND's collection, processing, and analytic capabilities, and 
promoted the close technical partnership between JSA and the BND. 

(S//SI//REL) Before the reunification of Germany, Schoningen (located on the 
former East-West German border) collected East German radar, radio, and 
microwave communications. When Germany reunified in 1990, BND personnel at 
Schoningen were forced to recreate their role and mission, Schoningen did so 
proudly, and now plays a key role in the BND's Counterterrorism (CT) and Force 
Protection efforts by collecting mobile communication systems (specifically 
Thurava. INMARSAT, and GSM), 



(S//SI//REL) Today, Schoningen is manned with approximately 100 personnel. There 




(S//SI//REL) Schoningen personnel focus on development and production of voice 
and facsimile traffic collected from Thuraya, INMARSAT and GSM, Schoningen 
collects over 400,00^Thuray^ut^e^da^^4j00^^^^RSAI^ut^m^6^00^GSM 
1 i.h- 1 1 ■ m h"l I'i 1 I'm 

network. E-mail is also collected at site, with an average of 62,000 collects per day, 
from this collection, especially the Thuraya intercepts from 
which the BND shares on a daily basis , 

(S//SI//REL) Site analysts and linguists are responsible for evaluating collected 
traffic, transcribing voice cuts and forwarding raw cuts on to their I IQS for further 
evaluation and reporting. To improve their collection and SIGDEV capabilities, site 
engineers have developed several systems to improve BND call-chaining 
capabilities, data-viewing of voice and fax data, and data- forwarding to BND IIQS. 
Development efforts at a field site are unusual for BND, and it was interesting to 
learn about these on-site efforts. 



NSA benefits 




(S//SI//REL) The second visit by JSA and NSA Headquarters analysts represented 
the first technical exchange with BND Schoningen, US analysts were shown several 
BND analytic tool suites, some of which were under development, BND contract 
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software developers and analysts sought regular feedback on the utility of these 
tools and techniques. These tool suites, such as MIRA 4 , integrate multiple 
database analytic functions (such as viewing voice and listening to fax), much like 
NSA Headquarters has UIS (User Integrated Services), In some ways, these tools 
have features that surpass US SIGINT capabilities, Among a series of interesting 
items, NSA analysts noted that DND analysts could seamlessly move from VERAS 
(call-chaining software) to the associated voice cuts, DND Schbningen also 
performed geolocational selection of mobile communicants. For instance, they 
could define any particular geographical area, like and select any 

communicant that dwelled in that area for several minutes, 

(S//SI//REL) DND Schbningen developers also demonstrated a software prototype 
that uses Social Network Analysis algorithms against metadata to discover and 
assess target groups among other things, looking for information flow. The goal (at 
least in part) was to monitor these targets in the background within analyst- set 
parameters, with alerts to notify the analyst when any anomalous measurement 
appeared, and potentially to steer front-end collection. They claimed to have some 
successes on small groups on which they had good collection, 

(S//SI//REL) They seemed interested in also characterizing movement patterns on 
geocoordinates to find persons such as couriers (terrorist or otherwise), then using 
that characterization for SIGDEV discovery purposes and predictive (trend) 
analysis, DND also showed us that they are interested not only in selection based 
on movement patterns or network structures, but also in hardware changes. They 
used a variety of algorithms (such as fuzzy logic) to discover these patterns. The 
DND responded positively to NSA's request for a copy of MIRA 4 and VERAS 
software, and made several requests from NSA concerning target and tool 
development and data, 

(S//SI//REL) This first series of meetings represents a new level of engagement for 
NSA and its German partner. We hope that this dialogue continues, and makes each 
partner more capable of satisfying common SIGINT requirements. 



(U) Notes: 

* DND = Federal Intelligence Service 

(U//FOUO) This article is reprinted from the Foreign Affairs Digest , September 
edition. 
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Overview 



Special Collection Service 



• Unified IT Core and Virtualization 

• Cloud Computing 

• Global Situational Awareness 

• Beyond Traditional Accesses 

• Coherent Digital Access 

• Empowering Automation 

• The SCS Cyber Advantage 
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Unified IT Core 



Collection Service 



• Capability Improvements: 

- Modern IT services and infrastructure to support a net-centric 
operational model and enhance maintenance and security 

• Capability Change: 

- Rapid response SIGINT presence 

- Next generation virtual infrastructure 

- Diversified WAN topology, enhanced LAN 

- Enhanced interoperable desktop 

- Improved email service 

- Workforce mobility 

- Robust collaboration environment 

- Site destruct enabler 
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Special Collection Servic 
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EINSTEIN/CASTANET 
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Special Collection Service 



INTERQUAKE 



• Terrestrial Environmental Knowledge Base 

- Available to all NSA analysts and partners 

• PANOPLY populates IQ with Emitter 
information and reports including: 

- Signal Externals 

- Radio and Payload information 
-LACs and Cell ID’s 

- Protocol Stacks 
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CES/SSC/AAD VPN “Surge” 



• Main Goal: 

- To evaluate SCS VPN access and analysis to determine better methods 
of identifying and exploiting networks of interest. 

• Two Focuses: 

- What can we do with VPN data that is already ingested into the system? 

• Find better methods of reporting VPN stats and exploitation 
determinations from CES back to SSC and site. 

- Are there methods to better identify and survey VPN’s to provide CES 
the data they need? 

• Can we leverage MIRROR, DARKQUEST, PANOPLY survey 
information to quickly identify and report the presence of VPN’s in 
surveyed signals? 

• Can we use BIRDWATCHER or other means to automatically 
resurvey for key exchanges and obtain paired collect? 



TOP SECRET II COMINT II REL TO USA, AUS, CAN, GBR, NZL 




TOP SECRET // COMINT II REL TO USA, AUS, CAN, GBR, NZL 
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The SCS Cyber Advantage 



SIGINT prowess provides cyber advantage 



Broad Spectrum of Capability *’ 




• Unified operations provides holistic approach 
The right intelligence delivered to the right customer 

Home field advantage in adversary’s space 

Where our customers want us and our adversaries do not 
Capitalizing on the “element of surprise” 

Signal access for collection, exfil,and infil 

Microwave, WiFi, WiMAX, GSM, CDMA, Satellite, etc. 

Living in the environment 

Insights on infrastructure and configurations 
Discovery of targets, signatures, and behavior 

Tailored intelligence products 

Diverse products driven by national objectives and 
local needs through formal reporting, target packages, 
analytic insights, situational awareness, threat warning 



***.. Unique platform for conducting 
and enabling 1C operations 

Fully leveraging 30-years of experience within the NSA and 
CIA enterprises and using existing authorities 
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- SCS PoPs provide y 
opportunities for access, 
^enabling, and analysis y 



HACKERS 
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SCS Opportunities 
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(S//SI) One-Year Anniversary for SUSLAG 

FROM: (S//SI) 

SUSLAG (F28) 

Run Date: 06/10/2005 



Speciaf US Liaison Activity Germany has spent a year in a 11 tin can." (It‘s better 
than it sounds - it's the nickname for their new facility!) (S//SI) 
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(S//SI) In April, the Special US Liaison Activity Germany (SUSLAG) celebrated one 
year in their purpose-built facility on the German Ministry of Defense facility 
Mangfali Kaseme in Dad Aibling, Germany, SUSLAG (formerly known as Combined 
Group Germany) was compelled to find a new home by the closure of its previous 
host, BadAibling Station, 



(S//SI)^^^^^^^^^^fi™t Chief SUSLAG, helps^^^^^^(Chief of 
Engineering and Maintenance/KE-60) plant a tree in front of the new SUSLAG 
Mangfali Kaseme. Als^participatingaio, from left to right, 

(RF Engineering), aru^^^^^^^^^^fChief of Station, Mangfali 
Kaseme/LA-60). 

(S//SI) Thanks to the combined efforts of the Bad Aibling Transition Team, the 
Technical Support Program Management Office, Bundesnachrichtendienst (BND, 
the German intelligence service and our German partner), the European Technical 
Center (ETC), ITD, NCEUR, I&L**, and others too numerous to mention, the 
building was completed in just4 l /2 months, from groundbreaking to move-in, all 
during the depths of winter, (SUSLAG's BND colleagues affectionately refer to the 
new SUSLAG building as “Die Blechdose" or "the Tin Can," owing to its difference 
in appearance from the other buildings on Mangfali Kaseme - it has no windows, is 
made of metal and is shelter-like in appearance), SUSLAG went off NSANET at Bad 
Aibling Station on Friday, 3 April 2004, and reappeared on NSANET in the new 
facility on the following Monday, thanks to an outstanding team of IT professionals 
working through the weekend, 

(S//SI) In addition to SUSLAG's long-standing role as liaison to the German 
intelligence service, it is parent to two exciting joint ventures, the Joint 
Analysis Center (JAC) and the Joint SIGINT Activity (JSA). The Joint Analysis 




(S//SI) JSA, the JAC's younger sibling, was declared operational last year and 
continues to build toward full operating capability, which is expected by the end of 
2005, The JSA is the outcome of an agreement between the Director, NSA, and the 
President of the BND to launch a strategic cooperation initiative in the mutual 
pursuit of intelligence related to counterterrorism, counterproliferation, and other 
transnational targets, 

(S//SI) With the establishment of a US -only communications center in the new 
SUSLAG facility, it became possible to provide secure connectivity for JSA, piggy- 
backing on SUSLAG's connection to ETC, at which point the JSA comms pass 
through ETCs Third-Party guard device subsystem onto NSANET This provided for 
the first time an electronic connection from NSA to JSA for tasking to flow in one 
direction, and SIGINT in the other, JSA is primarily a SIGDEV asset from NSA's 
point of view, but is an essential component of BND's collection architecture, JSA is 
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unique as a jointly manned, jointly tasked DNI site, 

(S//SI) Following DIRNSA's dictum that making our foreign partners more capable 
also makes NSA more capable, NSA personnel assigned to JSA are teaching their 
DND counterparts new tools and techniques in advanced signals and protocol 
analysis and DNI exploitation. But this is far more than an academic exercise -- 
training is being conducted in the course of executing tasked mission, currently 
one NSA and two BND tasks, BND senior leadership recently commended JSA for 
their efforts, particularly the contribution that JSA's Afghan GSM** task has made 
to one of BND's highest priority task, Force Protection in Afghanistan, FQRNSAT 
/SCS Mission Management has assigned primary responsibility to JSA for 10 beams 
on seven satellites, and JSA is continually surveying these beams and feeding the 
resulting metadata to NSA systems, 

(S//SI) SUSLAG continues in its traditional role as SIGINT liaison to the 

Federal Republic of Germany, This role has been greatly facilitated by SUSLAG's 
new location on Mangfall Kaseme, NSA personnel interact daily with BND 
counterparts, coordinating policy, conducting technical exchanges, expanding the 
range of cooperation in SIGINT, and deepening the partnership in many ways. The 
availability of SUSLAG's secure VTC facility on Mangfall Kaserne allows for a close 
and continuing exchange with our partner based on an unprecedented series of 
VTCs, Additionally, visiting NSA technical experts have immediate access to BND 
counterparts, providing for an unmatched exchange of expertise, 

(S//SI) SUSLAG is now established on a solid foundation for years to come. In the 
past year, DIRNSA, SID's Deputy Director, and the Principal Director of Foreign 
Affairs have visited to add emphasis to their charge to Chief, SUSLAG to broaden 
and deepen the SIGINT relationship with the German partner, moving in new and 
exciting directions. These efforts have already begun to bear fruit, and the future of 
this productive partnership seems assured. 



**(U) Notes: 

ITD = Information Technology Directorate 
NCEUR = NS A/CSS Europe 
I&L = Installations & Logistics 

GSM = a type of digital cellular coraras (Global System for Mobile 
Co mm unications) 

(U//FOUO) This article is reprinted from May's Foreign Affairs Digest 
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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 




(S//SI//REL TO USA, A US, CAN, DEU, GBR, NZL) Special U.S. Liaison 
Activity Germany (S US LAG)/ Joint S1GINT Activity (JSA)/ Defense 
Communications Interoperability Group (DCIG), CLASSIFICATION GUIDE 

Guide Number (1 0-03) 



Effective Dale: 16 February 2005 




REASON FOR CLASSIFICATION: 1.4 (c), (d) 
DECLASSIFY ON: 20291123 
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CLASSIFICATION GUIDE TITLE/NUMBER* (S//SI//REL TO USA, AUS, CAN, 
DEU, GBR, NZL) Special U.S. Liaison Activity Germany (SUSLAG)/ Joint S1GINT 
Activity (JSA)/ Defense Conimuni cations Interoperability Group (DCIG), 10-03 

PUBLICATION DATE: (U) 16 Febmaty 2005 

OFFICE OF ORIGIN: (U) Foreign Affairs Directorate, European Affairs Office 
(DP 12) 

POC: (U//FOUO)^^^^^^^^^^| 

ORIGINAL CLASSIFICATION AUTHORITY: (U)^^^^^^ Principal 
Director, Foreign Affairs 



(S//SI//REL TO USA, AUS, CAN, DEU, GBR, NZL) BND - Bundesnachrictendienst - 
German Federal Intelligence Service, The fact that the BND has a SIGINT mission is 
UNCLASSIFIED, The fact that the BND has a presence at Mangfall Kaserne and the fact 
that the BND conducts SIGINT at Mangfall Kaserne ate both classified, 

(S//SI//REL TO USA, AUS, CAN, DEU, GBR, NZL) DCIG - Defense Communications 
Interoperability Group - DCIG is a cover designator used to represent the SUSLAG 
organization in UNCLASSIFIED fora, DCIG should not be used in UNCLASS1F1ED1ED 
fora in association with NSA, 

(S//SI//REL TO USA, AUS, CAN, DEU, GBR, NZL) FI FTYEXCL AI M - 
F1FTYEXCLA1M is the covetterm representing NSA’s contract with Computer Sciences 
Corporation (CSC) for mission support. All publicly available information regarding 
work on this contract at Mangfall Kaserne will be sanitized so that no association with 
NSA will be made. This will entail removal of references to Maryland Procurement 
Office/ MPO, NSA-related DODAlCs, NS A civilian/military affiliate names, NSA phone 
numbers, etc. (This is not an all-inclusive list.) 

(S/Si ,REL TO USA, AUS, CAN, DEU, GBR, NZL) JSA - Joint SIGINT Activity -JSA 
is the joint NSA/BND organization that performs SIGINT collection at Mangfall 
Kaserne, The title JSA should only be used in classified fora. 

(S//SL7REL TO USA, AUS, CAN, DEU, GBR, NZL) SUSLAG - Special U.S. Liaison 
Activity Germany - SUSLAG is the NSA organization at Mangfall Kaserne that 
conducts foreign liaison with the BND, JSA falls under SUSLAG for administrative 
actions. The title SUSLAG should only be used in classified fora. 
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Description of Information 


Classification/Markings 


Reason 


Declass 


Remarks 


A. (S//5L7REL TO USA, AOS, CAN, 


DEU, GBR, NZL) NSA PRESENCE AT MANGFALL K AS ERNE 


1 . (U) The fact of Lhe presence of 

U.S. personnel at Mangfall 
Kaserne. 


UNCLASSIFIED 


N/A 


N/A 


f (S//S1//REL TO USA, AUS, 
CAN, DEU, GBR, NZL) No 
association with NSA, 
S1G1NT, intelligence, or the 
BND. 


2 . (S//S Vf RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The fad 
of an NSA presence at Mangfall 
Kaserne. 


S EC RET//COMt NT 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1-4{C) (d) 


20291123 


(S//S1//REL TO USA, AUS, 
CAN, DEU, GBR, NZL) 
Mention of a S1G1NT mission 
at Mangfall Kaserne is 
classified 

S ECRET//COM1 NT// 

REL TO USA, AUS, CAN, 
DEU, GBR and NZL. 


3, (5//S Vf RE L TO USA, AUS > 

CAN, DEU, GBR, NZL) The fad 
of a SU SLAG presence al 
Mangfall Kaserne. 


S EC RET//COM! NT 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4(c) (d) 


20291123 


(S//S1//REL TO USA, AUS, 
CAN, DEU, GBR, NZL) 
Mention of a S1G1NT mission 
at Mangfall Kaserne is 
classified 

5ECRET//COM1NT// 

REL TO USA, AUS, CAN, 
DEU, GBR and NZL. 


4. (U) The fact of Lhe DC1G 

presence al Mangfall Kaserne. 


UNCLASSIFIED 


N/A 


N/A 


(S//SI//REL TO USA, AUS, 
CAN, DEU, GBR, NZL) No 
association with NSA, 
S1G1NT, intelligence, or the 
BND. 


(S//SL7REL TO USA, AUS, 
CAN, DEU, GBR, NZL) The fad 
of Lhe JS A presence a L Mangfall 
Kaserne. 


SECRET//COM1NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1-4 (c) (d) 


20291123 




B. (V) ASSOC LATIONS 










(U) Note that if an entity's association with NSA is classified, that entity's association with other NSA organizations is also 
classified. 


1 . (S//S Vf RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of NSA with 
SUSLAG. 


SECRET//COMINT 
REL TO USA, AU S, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291 123 




2 . (S//S t//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of NSA with the 
DC1G. 


SECRET//COMINT 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291 123 




3. (S//S [//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of SUSLAG with Lhe 
DC1G. 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 

DEU, GBR, NZL 


14(c) (d) 


20291 123 
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4. (S//S 17 RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of SUSLAG with Lhe 

bn a 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 

DEU, GBR, NZL 


1-4 (c) (d) 


2029 1 L23 




!L (S//S 1//RE L TO U S A, AU S , 
CAN, DEU, GBR, NZL) The 
association of Lhe DOG wilh the 
BND. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR and NZL 


1.4(c) (d) 


20291 123 




6, (S//S 1//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of N SA with Lhe JSA. 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


l-4{c) (d) 


20291123 




77 (S//S 17RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of SUSLAG with Lhe 
JSA. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4(c) (d) 


2029 1 L23 




H, (S//S 1//RE L TO U S A, AU S , 
CAN, DEU, GBR, NZL) The 
association of the DOG with the 
JSA. 


SECRET//COMINT7/ 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291 123 




9. (S//S 1//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of the JSA with the 
BND. 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4(c) (d) 


20291 123 




C. (S//5L/REL TO USA, AOS, CAN, 


DEU, GBR and NZL) N5A/BND RELATIONSHIP 


1 . (S//S [//RE L TO U S A, AU S , 
CAN, DEU, GBR, NZL) The 
association of NSA with Lhe 
BND. 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR and NZL 


14(c) (d) 


20291123 




2. (S7S17REL TO USA, AUS, 
CAN, DEU, GBR, NZL) The fact 
that the BND is one of NSA's 
Third Party partners. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291123 




3. (S//5I//REL TO USA, AUS, 

CAN, DEU, CBR, NZL) Details 
regarding the NS A' BND S1C1NT 
relationship. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 
(at a minimum) 


1-4 (c) (d) 


2029 1 L23 


(U) Consult the Country Desk 
Officer for Germany for 
additional in formation. 


D. (U) CONTRACT IT SUPPORT 


1, (U) The association of NSA 

with the FIFTY EXCLAIM 
contract. 


UNCLASSIFIED 


N/A 


N/A 




2 , (S//S 1//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of SUSLAG with Lhe 
FIFTY EXCLAIM contract. 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1-4 (c) (d) 


20291 123 




3, (S//S [/RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
association of DOG with the 
FIFTY EXCLAIM contact. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291123 




4. {S//S1//REL TO USA, AUS, 

CAN, DEU, GBR, NZL) The 
association of JSA with the 
FIFTY EXCLAIM contract. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


14(c) (d) 


20291123 
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3. (S//S 1//RE L TO U 5 A, AU 5 , 
CAN, DEU, GBR, NZL) The 
association of the BN D with the 
FIFTY EXCLAIM contract. 


S ECRET//COM1 NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1-4 (c) (d) 


20291 1.22 




E. (S//5L7RELTO USA, AUS, CAN, DEU, GBR, NZL) SUSLAG/DC1G MISSION 


1 . (S//S 1//RE L TO U 5 A, AU S , 

CAN, DEU, GBR, NZL) The 
identification of the SUSLAG 
mission as follows: 

“SUSLAG is DIRNSA's in- 
theater foteign liaison 
representative to the BND 
S1G1NT organization/' 


S E CRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, and NZL 


l-4(c)(d) 


20291123 




2. (U) The identification of the 

DC1G mission as follows: 

“DOG is an organization of DoD 
technicians and U.S. contractors 
that provide operations and 
maintenance support for antennas 
and high-performance 
communications equipment at 
Mangfall Kaserne/' 


UNCLASSIFIED 


N/A 


N/A 


(S//S1//REL TO USA, AUS, 
CAN, DEU, GBR, NZL) The 
association of the DC1G with 
its true S1G1NT mission is 
classified 

S E CRET//COM1 NT// 

REL TO USA, AUS, CAN, 
DEU, GBR and NZL at a 
minimum, depending on the 
level of detail provided. 


F. (S//SI7REL TO USA, AUS, CAN, DEU, GBR, NZL) JSA MISSION 


I . (S//S L7 RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
identification of the JSA mission 
as follows: 

“The JSA is ajoint NSA-'BND 
organization whose mission is 
S1G1NT development and 
collection of digital network 
communications and 
international telecommunications 
traffic.” 


5 ECRET//COMINT// 
REL TO USA, AUS, CAN, 
DEU, GBR, and NZL 


1-4 (c) (d) 


20291123 




2 . (S//S [//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The fact 
that NS A and BND jointly, as 
JSA, perform S1G1NT collection 
at Mangfall Kaserne, 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 

DEU, GBR, NZL 


1.4(c) (d) 


20291123 




3, (S//S [//RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) Details 
regarding S1G1NT collection 
performed by JSA at Mangfall 
Kaseme. 


S ECR ET//CO MINT// 
REL TO USA, AUS, 
CAN, 

DEU, GBR, NZL 

(at a minimum) 


1.4(c) (d) 


20291123 
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4. (S//S 17 RE L TO U S A, AU S , 

CAN, DEU, GBR, NZL) The 
identification of entities or 
communications technologies 
targeted and/or collected by JSA. 


S ECR ET//CO MINT// 
REL TO USA, A US, 
CAN, 

DEU, GBR, NZL 

{ala minimum) 


1.4(c) (d) 


20291123 




IT (S//S 1//RE L TO U S A, AU S , 
CAN, DEU, GBR, NZL) The fad 
that JSA targets and collects 
satel 1 i Le common ications 
( FOR N SAT). 


S ECRET//COMI NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4(c) (d) 


20291123 






7. (S//S L7RE L TO U 5 A, AU 5 , 

CAN, DEU, CBR, NZL) The fact 
Lhat JSA has a SIC 1 NT 
development mission. 


SECRET//COM1NT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4 (0) (d) 


20291123 




H. (S//S Uf RE L TO U S A, AU S , 
CAN, DEU, GBR, NZL) The fact 
that JSA forwards selected target 
communications Lo NS A. 


5ECRET//COMIINT// 
REL TO USA, AUS, CAN, 
DEU, GBR, NZL 


1.4(c) (d) 


20291123 
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[edit] News 

BREAKING NEWS (May 2012) - The second tranche of 'deep dive 1 processing capability at 
RPC has gone live. In addition 2 extra IDG's are being processed at OPC. This brings the current 
'deep dive* capability to: 

• CPC with 16x1 Og, 

• OPC with 7 x 1 Og 

• RPC1 with 23 x lOg. 

This gives over 300 GCHQ and —250 NSA analysts access to huge amounts of data to support the 
target discovery mission. 

The MTI programme would like to say a big thanks to everyone who has made this possible 
(Which includes TGA, TEA, SSMG, SSGS, GTE, ACD, OPP-LEG, IT Services, R1 at 

n 

NSA r AHS and ) - a true collaborative effort l 

1 LMPOKA delivered led js 

of the MTI SIGINT Apps theme led by and 

[edit] TEMPORA 



TEMPORA Is an Internet Buffer capability being delivered by MTI, IPP and GTE for joint mission 
benefit. It builds upon the key success of the TINT experiment and will provide a vital unique 
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capability to MISD/MCE communities. 

* TEMP ORA is the codeword for GCHQs internet buffer business capability as a whole - which 
is the ability to loosely promote a % of traffic across GCHQs SSE access into a repository 
which will keep the content (and its associated metadata) for periods of time (approximately 
3 days for content and up to 30 days for metadata) to allow retrospective analysis and 
forwarding to follow on systems. 

* TEMPQRA as a capability is agnostic of the technologies used to promote that traffic and to 
store that traffic and so should not be used as a codeword for the individual components (e.g 
XKS, MVR etc). 

* At the moment the components include, amongst others, GCHQ SSE Access, POKERFACE 
sanitisation, XKS (in various configurations) and it will include MVR in the very near future. 

* TEMPQRA also covers the management of the rules used to promote traffic into the internet 
buffer capability. 

* TEMPQRA is not processing centre specific. At the moment there are instances of 
'TEMPQRA at all xPC (Namely CPC, QPC and RPCI). These should be referred to, when 
required, as GPC/CPC/RPC1 TEMPQRA 



TEMPQRA are GCHQ's large-scale, Deep Dive deployments on Special Source access ( SSE ), 

Deep Dive XKeyscores work by promoting loose categories of traffic (e.g., all web, email, social, 
chat, EA, VPN, VoIP..) from the bearers feeding the system and block all the high-volume, low 
value traffic (e.g., P2P downloads). This usually equates to —30% of the traffic on the bearer. We 
keep the full sessions for 3 working days and the metadata for 30 days for you to query, using all 
the functionality that Keyscore offers to slice and dice the data. The aim is to put the best 7.5% of 
our access into TEMPQRA 1 s, comprising a mix of Deep Dive Keyscores and promotion of data 
based on IP subnet or technology type from across the entire MVR. At the moment, users are 
able to access 46x1 OGs of data via existing Internet Buffers.. This is a lot of data! Not only that, 
but the long-running TINT program and our Initial 3-month operational trial of the CPC Internet 
Buffer (the first operational Internet Buffer to be deployed) show that every area of ops can get 
real benefit from this capability, especially for target discovery and target development. Internet 
Buffers are different from TINT In that the latter Is purely an experimental, research environment 
whereas Internet Buffers can be used operationally for EPR, Effects , enabling CNE etc. 

For a more detailed depiction of how TEMPQRA and TINT differs please see here . 



[edit] A bit more detail 



[ edit ] Contacts 



N nine 



Role 




GTE XKS Senior User 
MTI SIGINT apps theme lead 
Enhanced Discovery Project Manager 
Enhanced Discovery XKS SME 
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(U//FOUO) OPERATIONAL HIGHLIGHT 

WHARPDRIVE 1 



(TS//SI//NF) SSO was informed on 12 March 2013 that the access 
point for WHARPDRIVE was discovered by commercial 
consortium personnel. Witting partner personnel have removed 
the evidence and a plausible cover story was provided. All 
collection has ceased. 

(TS//SI//NF) SSO was planning to conduct a week of training in 
April and support a deployment in June, however, the partner 
has requested to delay both training and shipping. 
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XKeyscoreTabs XKS Development 



Jump to: navigation - search 



News 


Getting 

an 


Using 


Train inn 




Account 


XKevseore 





XKS 

Development 



XKS 

Contacts 



Requirements 



News 

Archive 



Contents 

* 1 XKS Upgrades 

* 2 Guidance on micropluuiris 

* 3 Types of XKEYSCQ RE 

o 3.1 Traditional 
o 3.2 Stage 2 
o 3.3 Deep Dive 

* 4_Skinny XKS 

f edit l XKS Upgrades 

XKS is upgraded fortnightly on Thursday 
mornings between 0900-1100. If you can't Lug 
un or use the tool during this period, its 
because of this. 

[edit] Guidance on 
microplugins 

As you know, you can create microplugins to do 
different things: some perform advanced detection 
techniques to find types of traffic which can't be 
detected by keywords or regular expressions alone. 
Others identify and extract data fields into XKS's 
metadata table. 



Quick Li nks 

* XKEY5CORE Main Page 

* XKS ft- scale on SSE 

■ Getting Strong- Selected Content into XKS 
*■ -Getting an XKS Account 

* Using XKEYSCQ RE 

■ XKEYSCQ RE Training 

* XKEYSCDRE Development 

■ XKEYSCQ RE Contacts 

■ XKS News Archive 

* XKS Requirements 

*■ XKS Searches user guide 

■ XKS Results user guide 

* XKS Approval process 

* NFVlnXKS 

* Promotion from XKS 

* Automatic Promotion from XKS 

* XKS tor CNE 

■ NSAXKcy score Using XKS tor CNE 

* XKS Toed Dictionaries 



Useful Links 

* Mastering The Internet 

■ T ra ns form in g Ana ly si s 

■ TINT 

* GTE 

* SD Homo 

v i d i c 



In the latter case, the extracted content fragment* are Stored in the metadata table for 30 days. 

It wiJJ depend on the precision and nature of the search criteria you have used as to how strongly 
- or weakly - selected that content will be. 

If you are going to use search criteria that will extract data about people and store that in the 
metadata table, please consult GPP LEG before doing so. They will wish to understand the nature 
and scope of any data being stored in case it includes at least the names of individuals and the 
majority of the data is not believed to relate to probable intelligence targets. This would make 
this data particularly sensitive. 

In addition, a quarterly check is now being made on all new microplugins which add data to the 
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metadata table to ensure they meet UK legal and policy requirements. 

Please also be aware that usually micro plugins are automatically shared with at least NSA and 
may also get deployed to other 2P XKS. By mid -20 11 a new version of XKS should have been 
deployed where individual micro plugins will still be deployed to every XKS, but they can be 
tagged not to run on certain XKS. The only exception is where you deploy a micro plugin only to 
GTE's XKS fleet: these will not be visible to 2P partners. 

[editj Types of XKEYSCORE 

There are currently three different types of XKS: 

* Traditional 

* Stage 2 

■ Deep Dive 

They differ principally on where in the processing chain they sit whether the data they receive 
has already been sessionised or not and whether they ingest all of the data they receive or 
whether they apply rules to only ingest some data. 

[Mill Trad ill tin al 

When XKS was Erst developed it was used to receive data from low data rate signals being 
processed through W E A LTH YC LU ST ER (WC). WG sessionised all the data on the Jink and 
presented it all to XKS. All data was ingested into XKS. 

GCHQ has traditional XKS at many of our sites, including all of our Comsat, Terrestrial and SMO 
sites. The EREPO XKS is also a traditional XKS, though in that case data has been softly selected 
at the implant and sessionisation takes place in TERRAIN , rather than WC. 

r edit l Si. dye 2 

For higher data rates, a "Stage 2" XKS was developed to ingest data from TURMOIL . TURMOIL 
passes 5% of the packets to XKS which XKS then session ixes. TURMOIL decides which 5% of 
packets to pass based on the following criteria: 

* strong selection 

* subnet promotion 

* technology promotion 

* e-mail domains 

* persona session promotion (where if a strong selector is seen, 10 minutes" or 10 MB of data 
is collected) 

* persona session collection (where the data is collected and forwarded to NS As PIN WALE 
but is also passed to the XKS) 

This data is then sent to the Stage 2 XKS. All other data is lost. 

Only JPC (MUSCULAR) at GCHQ uses a Stage 2 XKS. 

[ed||] Deep Dive 

Deep Dive XKS was developed to prove that sessionisation at 10G data rates was possible. First it 
sessionises all data on a link. Then it promotes data using the GENESIS selection language to 
identify data types where we assess there is potential intelligence value and ingests those. The 
promotion process can make one of three decisions: 

* Block data that is legally not allowed to be in the system - ie UK-UK traffic 

■ Allow data that is known to be wanted through use of promotion rules 

* And then to drop any data that doesn't meet either of these 

One of the experiments in TINT is seeking to identify where the best balance lies between what 
is kept and what is not. A factor in deciding how much data to keep is the scale of storage 
capacity that can be provided. 

GCHQ already operates a number of Deep Dive XKS: 
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Director S1GINT Analysis and Production 
German Federal Intelligence Service 
30 April -1 May 2013 



30 April 2013 

Time Presentation Title and Presenter Location 

0350 (U//FOUO) W elcome GH 2B 

Hr. Diet mar 

Director, SIC 11 NT Analysis and Production, BND 

Hr. Wilfried 

Director, Data Acquisition, BND 

Hr, Andreas 

Director. BND Cyber Defense Center 
Chief, Tasking and Customer Relations 



Liaison Off icer 




Senior Analyst. C o unterprol iferat ion 

Senior Analyst, Political/Economic Issues, Pakistan 




Senior Analyst, Counterterrorism 
Senior Analyst. Africa 
BND Liaison Officer, W as hi ng ton 
SUSLAG Liaison Officer 



Metand escorted b 




D1RFA; | 

I, CH SUSLAG Designee; and 
NSA/CSS Protocol Officer. 



0900 -0920 



F or einr^^fah^Direct orate (FAD) Courtesy Call 

D1RFA 



2B4113-5 
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VISIT PRECIS 
Hr. Dietmar 

Director SIGINT Analysis and Production 
German Federal Intelligence Service (BND) 

30 April - 1 May 2013 

SID DIR Courte sy Call: 30 April 2013, 1100= 1130 

^^^^^■SUSm^esignee; D DA; Mr| 

D/A&P; Chief SSG?M5^^^^^(- SUSLAG 

Designee; Ms. CDO Germany 

(U) BACKGROUND: 

* (S/yREL TO USA, FVEY) Hr, assumed his current position in 

2011 and is marking his second visit to NS A, He is rumored to be under consideration to 
become the next SIGINT Dire ctor, succeeding MG Hartmut 1 He will be 

accompanied by Hr. Wil fried f^B Direct or of SIGINT Collection, and the following 
BND leadership: 

Hr. Andreas Director, BND Cyber Defense Center 

^^^^^^^^^^^Chief, Tasking and Customer Relations 

BND Liaison Officer, Washington, D.C. 



Participants: Mr 



(U) PURPOSE OF THE VISIT: 

* (S/yREL TO USA, FVEY) Discussions during the third Strategic Planning Conference 
(SPC) will focus on topics of mutual interest and future areas of collaboration. With 
NSA’s encouragement, the Germans are coming prepared to define specific capabilities 
in potential new r areas of analytic and Computer Network Defense (CND) collaboration. 
This SPC will present an opportunity for NS A/CSS leadership to assess the BND’s 
contributions and reiterate their commitment to the German partnership. SID DIR’s 
discussions will set the tone for a productive conference. 

(U) VISITOR R EQUESTED: 

* (TS//5L.REL TO USA, DEU) The BND is eager to present its SlGlN^capabilities and 

gaps on the targets and with the goal 

of expanding the partnership. Their delegation includes several senior analysts, w r hoare 
prepared to engage NS A leadership in identifying areas of mutual cooperation. The BND 
also is prepared to discuss progress of the new r BND Cyber Defense Center and the 
policies and authorities governing the mission, w r hile seeking lessons learned from NS A. 



(U) NSA/CSS REQUESTED: (TS//SI//NF) Status of BND-NSA bilateral initiatives, 
highlighting: 



Identify mutual intelligence gaps on| 
areas 



Lind | 



| target 
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* Enhanced CT analytic and SIGDEV technical coopetation with BND andl BfV (Federal 
Office for the Protection of the Constitution) given the formalization of the NSA-BfV 
SI GIN T partnership in March 2013. 

* Discussion of German policies/authorities of the new BND Cyber Defense Center and 
collaboration with the defensive mission; N'TOC will brief TUTELAGE 

* Status of^^^^| and Special Source access programs 

* G ermany's supp ort to the SIGINT Coalition and continued support 

in^^^^^^|for the SIGINT Counter- IE D mission and global 1ED [lire at. 

(U) CYBERCOM REQUESTED: N/A. 

(U) COMMON THREADS: (TS//SI , REL TO USA, DEU) 

* NS A welcomes the BND’s eagerness to strengthen and expand cooperation with NS A 

* Investing in BND’s technical expertise to support the BfV and other German services 
could bolster Germany’s effectiveness against terrorism and cyber threats 

(U) KEY TOPICS 

* (S//REL TO USA, DEU) Thank Hr. B^^^H for the close partnership that NS A enjoys 
with the BND 

* (S//SI//REL TO USA, FVEY) Enhancing the technical and analytical capabilities of our 
Getman intelligence partners will better-equip Germany to counter terrorists; NSA’s 
desire to p ait ner closely with both BND and BfV 

* (TS//5I//REL TO USA, DEU) NSA’s willingness to explore new r areas of cooperation 
that fill mutual intelligence gaps 

(U) KEY TAKEAWAYS: 

1. (TS//SLREL TO USA, DEU) Expanding the Scope of Bilateral Cooperation : Duiing 
recent meetings with BND leadership. PIRNS A, DDIR, and SID encourage d the BN D to 

on a nd fo 

discussion at the SPC. Thank the BND for coming so w r ell prepared to discuss its potential 
contribution in these area and to give NS A the oppoitunity to evaluate w r here a formal 
bilateral pa it ner ship at the TS//51 level has the most promise. 

2. (S//SI//REL TO USA, DEU) Counterterrorism : Share that NS A received ODN1 
approval in Match 2013 to establish a format CT relationship with the BfV and anticipates 
increasing synergy against the target with BND/BfV/NSA collaboration; NSA also has 
signed the Terms of Reference to provision XKEYSCO RE technology to the BfV. Thank the 
BND for its leadership in providing technical solutions/support to the BfV. 

3. (TS//S1//REL TO USA, DEU) Computer Network Defense : Commend Germany for 
establishing the BND Cyber Defense Center in Berlin and the National Cyber Defense 
Centre in Bonn. Encourage BND/ BfV/ BSI (Information Assurance Seivice) collaboration to 
leverage SIGINT support to CND. Share that NS A is eager to learn more about German 
cyber authorities and is prepared to offer lessons learned and technical presentations, 
including TUTELAGE, to aid in the development of German SIGINT support to CND. 
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* (TS//5I//REL TO USA, DEU) BNP Collaboration with Special Source 

O Derations fSSQ) ; WHARPDRIVE fEMERALDl Thank the BND for their 
assistance with the trilateral program, acknowledging recent delays due to funding 
constraints by both partners. Reassure that the BND is the program lead with NS A 
playing a technical support role. For background only, WHARPDRIVE has been 
identified for possible termination due ro fiscal constraints, but tbe partners have nor 
been informed. 



5. (TS// S1 , REL T O USA, DEU) Middle East & Africa: Thank th e BND for providing West 

African language assistance used by high-level officials; State that NS A is 

looking forward to learning more about the BND’ s capabilities 

6. (TS//S1//REL TO USA, DEU) AFSC ; Commend the Germans for their support and 
leadership in RC-North Multinational SIGJN'T Cell and their efforts to contribute to Division 
-of-Effort Reporting on governance targets. Explain that German support 

will be critical in maintaining necessary threat warning and force protection in 2013/14 as 
MES becomes a logistical hub and potential egress route into^^^^^J Regarding the 
post-2014 disposirion of US. /drees, store that the coalition partners will discuss this topic at 
the early May 2013 AFSC conference in Denmark. 



7. (S//S1//REL TO USA, DEU) Counter- 1ED: Thank the BND for supporting the Counter- 
1ED mission in RC-North and for engaging the C1ED S JOINT Senior^urope (SSEUR) 
venues. NS A looks forward to continued cooperation in the post 2014 

environment on a global basis. 



a. (S//REL TO USA, DEU) NSA Manning at Bad Aibling Post-Summer 2013 : At the 
DDJR’s request in January 2013, SID re-evaluated the technical presence at SUSLAG. 
Convey that NSA has difficult choices to make in this challenging fiscal climate and will 
continue to keep the BND’s request for consideration. Reference the availability of VTC, the 
European Technical Center (ETC), and the CHATrERll communications tool to provide 
assistance. 



(U) VISIT FORMAT: 

* (TS^SFAIE^T^USA, DEU) The BND will provide briefings 

mmmand as well as on Germany’s posture on CND. 

* (TS//5I//REL TO USA, DEU) NSA Participants: SID DIR, D/D1RFA, 

ADD/ Acquisition; ADD/CT; GCM South Asia; GCM International Crime & Narcotics; 
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GCM Middle East & Africa; D/GCM CT; D/GCM International Security Issues; Chief 
SIGDEV; D/CH NTOC 

(U) PREVIOUS VISITS AND RESPECTIVE TOPICS: Hr. st visited NS A in 

December 2011 for familiarization with NS A’ s mission and discussions with SID leadership. 

(TS//SI//NF) POTENTIAL LANDMINES: 

* (TS//SI//NF) SKYPE: The Germans may bring up the subject of SKYPE. NS A’s 
response has been that it has had some success working SKYPE via tailored access at the 
end point by gaining access to one or more of the computers involved in the session. 
When Hr. Klaus -Fiitsche (State Secretary, Germany Ministry of Interior) sought NS A’s 
assistance w r ith intercepting SKYPE transmissions during a 10 January 2012 meeting 
with D1RNSA, D1RNSA suggested the DNJ Representative Berlin take the lead in 
arranging an exchange to include CIA, FBI and NSA. Should the partner raise this issue 
again, recommend that NSA once again redirects them to FBI and CIA. 

(U) OTHER INFORMATION: 

* (S//NF) BIOs: l^^Mand 

* (TS//5F7NF) Talking Point Papers: S2A, S2E, S2G, S21, S3, and NTOC 

(U//FOUO) POCi^^^^H CDO Germany, 
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FINAL AGENDA 



Date/Time oe Visit : 



Protocol Rep: 
Visit manager: 




(U) 30 April - 1 May 2013 
30 April 201 3//0930-1 645 
1 May 201 3//Q850- 1600 




Visitor: 



(U) 



HR. DIETMAR 




Title: 

Countr y/Qrcantea tion: 



Equivalency: 



(U//FOUO) Director, SIGINT Analysis and Production 

(U//FOUO) Germany/German Federal Intelligence Service (BND) 
SIGINT Directorate 

(U//FOUO) Deputy Director Analyis & Production 



Accompanied by: 



Interpreter: 



(U//FOUO) HR. WILFRIED 
Di lector, Data Acq uisition. BNP 
HR. ANDREAS ] 

Director, BND Cv her Defense Center 




lief, Tasking and Customer Relations 




Liaison Officer 




Chief SIG DEV 





BN D Liaison Officer, Washington, D.C, 



Liaison Officer, SUSLAG 
(U//FOUO) None. 



Classified 

Derived From: NSA/CSSM 1-52 
Dated! 20070 1 OS 
Dec lass i fy On l 205S040 1 
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Previous visits : 
Clearances: 

Accompany inc ASA/CSS 
Senior: 

Photographer: 

Memento Presented: 
Unieorm of the Day: 
Purpose of Visit: 

Justification for 
Directorate Involvement: 

Expected Outcome: 



(S//REL) Hr, I last visited the Directorate in December 

2011 , 

(U) TS//S1 

(U//FOUO) 

Deputy Director Foreign Affairs (D/D1RFA) 

(U) No. 

(U) No. 

(U) GEN A: Class B; D/DJR and Guests: Business Attire 

(S//REL) Hr, B^^^HwiLL be leading the German delegation for 
the Strategic Planning Conference (SPC), 

(S//NF) Germany is an active, valued partner and Direct or ate- level 
involvement in the SPC will underscore, for the Germans, the value 
of the partnership between NSA/CSS and BND. 

(S//NF) To explore topics of mutual interest to both partners in an 
effort to move the relationship forward over the next year. 




Chief of Protocol 
and Coiporate Events 



NS ACSS Protocol Office 
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Derived En>m: NSAJCSSM 1-52 
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HR. DIETMAR 

Director, SIGINT Analys^anWroaucnori 
German Federal Intelligence Service (BMD) 



30 April 2013 

Time Presentation Title and Presenter 

0930 (U//FOUO) Welcome 




Location 

GH1 



Met and escorted b 
CDQ; 





DD1RFA; | 

|, GH SUSL AG Designee; and 
NSA/CSS SID Protocol Officer’ 



0940-1000 



^oi^igr^^ait^Directorate (FAD) Courtesy Call 

D/D1RFA 



2B4118-9 



1000-1049 




Discussions with the Office of South Asia 

Global Capabilities Manager (GCM), Office of 



2B4118-9 



South Asia 



1100-1130 



1149-1230 




2W102 



Canine 

Annex 
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International Crime and Narcotics (1CN) (Host) 
(By Invitation Only) 





1230-1300 (U//FOUO) 1CN Discussions 2B4118-5 

|, GCM 1CN 

| , Chief of Operations, 1CN 
|Foreign Affairs Officer 

(U//FOUO) Data Acquisition Directorate Courtesy Call 2B41 18-5 

D/DIR for Data Acquisition 
| Assistant D DIR for Data Acquisition 

(U) Break 

(U//FOUO) Data Acquisition Special Project Discussions 2B41 18-5 

CH Radio Frequency Targeted Operations 

Office (RFTO) 

|CH RFTO Special Projects Office 
_CH Special Source Operations (SSO) 

SSO 

1430-1500 (U//FOUQ) Combating Proliferation Counter- Improvised Explosives 2B4118-5 
Device (CIED) Discussions 

|CH CIED Division 



1300-1330 

1330-1345 

1345-1430 




1 500-1530 (U//FOUO) Office of C hina and Korea (OCK) Discussions 

Analyst 

Foreign Affairs Office 



1530-1630 



(U//FGUQ) Office of Middle East and Africa (MEA) and Iran 
Discussions 




GCM MEA 



1630-1645 




Discussions 

CDO 



2B4118-5 



2B4118-5 



2B4118-5 



1645 (U) Depart GH 2B 

1800 (U//FOUO) SID Host ed Dinner Clyde’s 

Associate D/DIR for Counteiterrorism Columbia, 

(ADD/CT) (Host) MD 

(By Invitation Only) 



HR. DIETMAR 




Director, SIGINT Analysis and Production 
German Federal Intelligence Service (BND) 
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1 May 2013 

Time Presentation Title and Presenter 

0850 (U) Arrive 



Location 

GH 2B 



0900-1015 



U//FOUO) Office of Counterterrorism Discussions 



| ADD/CT 

D/GCM CT-S1GDEV 

1, CT Subject Matter Expert (SME) 



2B4118-5 



1015-1 100 (U//FOUO) office of S1G1NT Development Strategy and Governance ZB4118-5 
(SSG) Discussions 

ADD/SSG 

^^^^^^^HTFech DIR 

D/GCM CT-SIGDEV 



1 105-1 155 
1 Z00-1 245 



1300-1400 



^^FOUO^S^CSS Threat Operations Center (NTOC) Discussions ZB41 18-5 
d/dir NTOC 

(U/'FOUO) Foreign A ffairs Directorate Hosted Lunch Canine 

D1RFA (Host) Suite 

(By Invitation Only) 

(U//FOUO) TUTELA GE Presentation 2B4118-5 

^^^^^■D/DIR NTOC 

Assoc. DIR Special Projects, NTOC 



1415-1500 



1500-1 GOO 



(U//FOUO) Office of International Security Issues (IS1) Discussions 

D/GCM 1SI 

Branch, NSA-Texas (NS AT) 

(U) Wtap-up Discussions 

CH SUSLAG Designee 



ZB4118-5 



2B4118-5 



1G00 



(U) Depart GH ZB 

Met and escorted by SACS S SID 

Protocol Officer 
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Talking Point Topics Proposal 



Name and Title of Visitor: (U//FOUO) Hr. Dietmar Analysis and Production, 

German Federal Intelligence Service (BND) and Hr. Wilfriedl^^Chief of Collection, BND, 

Accompanied by: Hr. Diet mar Chief Analysis & Production, German Fe deral 

Intellmenc^ieivice (BND); ^^^^^^^^^^J chief of Station, German Embassy; 

BND Liaison Officer, Washington; Representative, 

Berlin 

Date of Visit: (U) 30 APR - 1 MAY 2013 

Visit Background: (TS//SLVREL TO USA, FVEY) Hr. B^^^and Hr. hflwill be attending 
the Strategic Planning Conference, the goal of which is to do planning for the German 
partnership with NS A. 

NTOC Topic(s): Computer Network Defense (CND) - Germany: 

(S^REL TO USA, FVEY) Both German President Schindler, and BND SIGIN'T Di lector, BG 
F^^^H continue to express a desire to increase CND engagement w r ith the NSA. In addition, 
they have already expanded their cyber collaboration with the Federal Office of Information 
Security (BS1) and BfV by establishing theT4 (Cyber Intelligence) organization. 

(S//REL TO USA, FVEY) As CND continues to be the focus of much discussion with NSA’s 3 rd 
Patty Partners, Germany is no exception. They continue to seek guidance and advice regarding 
their CND effort. The T4 organization, although not expected to be fully staffed for almost one 
year, is almost fully staffed. Of the ^150 positions within this new r organization, more than 130 
are already filled and the remaining billets are to be filled by ‘hackers', w r hoare still being 
recruited. 

(C.vREL TO USA, FVEY) In preparation for the 8 May visit by Dr. Maassen, Director BfV, Dr. 
Massen’s office asked for NSA’s general assessment of the Mandiant Repo it and our comments 
on the structure and responsibilities. No answ r er w r as returned to BfV as this is supposed to be a 
discussion topic duting his visit. Regarding the Mandiant Report, NSA w r as aw r are of it prior to 
its release, but NSA did not request its public release nor contiibute to it. Notification of this 
report to our SSEUR partners was given via S1GDASYS, prior to the release of the report. 

(S//REL TO USA, FVEY) During a VTC held in early February with personnel from NTOC, 
FAD, SUSLAG, BND, BSland BfV, several observations w r ere made: 

(S//NF) 

• BN D / BSI/B fV J s CND capability is unclear ; 

* NSA’s Defense Industrial Base (DIB) pa it ner ships and how r NTOC gained cooperation 
w r as of interest to BSI; 



Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20320108 



TOP SECRET//SI//NOFORN 




TOP SECRET //CO M INT//NO FORM 



* German law cuirendy prohibits BND/BSl/BfV from doing ‘neat’ teal time’ cyber defense 
activities; 

■ NTOC provided a summaty of TUTELAGE and how r it is utilized on the NIPRNet within 
the . mil space, and 

* NTOC requested follow' on information on Germany’s unique apertures forSIGINT, their 
ability to consume NS A reporting/data, feedback on the reporting/data being provided 
and defense and national level network technical informal! on/a rchi lectures. 



LANDMINE : (S//NF) The potential analytic and operational mission cost for engaging w r ith the 
Germans appears to be much greater than the value gained by NTQC. NS A should continue to 
track the Germans’ progress and commitment before investing heavily in analytic and 
operational exchanges. 



WAY AHEAD : (S//NF) 

* Continue to encourage BND/BSI/BfV to collaborate regarding CND; 

* Continue to assess BND/BSl/BfV ’s capability for collection, analysis, and/or attribution 
of cyber threat; 

■ Continue to encourage BND/BSl/BfV to leverage S1GJNT to support CND; 

* Explore options for providing Lessons Learned on cyber technical, process, and training 
topics that aid in the development of German S1GJNT support to CND, and 

* Offer selected briefings/lessons learned discussions via a VTC later this year. Potential 
topics include: TUTELAGE/DECS implementation, ESF program overview' and 
administration, methodologies for building intro si on sets (Diamond Model, etc.), and 
lessons learned on ope rations /intrusion set development 



NTOC Point of Contact: (S//REL TO USA, FVEY) 
19 April 2013. 
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